Claude Code 2.1.299 blocks a sandbox write path into reloadable plugins.

The patch closes a path through which a sandboxed shell command could write into a --plugin-dir folder. Claude Code reloads that code and runs it outside the sandbox. The release also fixes a mod that could keep a headless run going beyond its turn or dollar limit. Both fixes are in 2.1.299, published at 02:49 UTC. ¹

Check both the plugin write boundary and the stop condition. Upgrade affected installations before running another unattended task with reloadable plugins. In a disposable setup, try a sandboxed write to the plugin directory and confirm that a turn-ending mod stops at the configured limit.

The vendor notes establish the repaired paths. They do not establish whether a particular deployment was exploited or whether every plugin is safe. Keep plugin source directories outside the writable task area and preserve the version with the test result.