Claude Code 2.1.309 fixes over ten sandbox and permission bypasses

Claude Code 2.1.309 patched more than ten ways around its sandbox and permission checks, including shell startup files running outside the sandbox and deny rules bypassed via symlinks and redirects. Codex 0.164.0 hardened its sandbox checks, added credential masking and a /presets command with ten slots.

• Claude Code 2.1.309 fixes over 10 sandbox and permission bypasses
• Codex 0.164.0 adds /presets, inline /model arguments and credential masking
• Gemini CLI 0.65.0 enforces read-only settings in untrusted folders
• New claude_code.safety_event telemetry records blocked tool calls