Ing. Calogero Bono
Anthropic has published version 2.1.325 of Claude Code on GitHub, the command-line tool for programming with AI. The release fixes a security issue in how responses compressed with zstd are decoded. The rest of the list is long and covers permissions, sessions, login, MCP servers and telemetry. For those who use the tool in a company or on shared servers, the most important part concerns blocking rules, which in some cases did not apply as expected.
A few terms before we get into the facts. zstd is a data compression format, also used in network responses. MCP is the protocol through which Claude Code connects to external tools and services. Subagent is a secondary agent launched by the main session. Worktree is an additional working copy of the same git repository. OpenTelemetry is the standard for collecting usage events and metrics.
What security problem does 2.1.325 fix?
The official release notes only say that a security issue in the decoding of responses compressed with zstd has been fixed. They specify neither severity nor exploitation method.
The rest of the security fixes concern permissions. Relative blocking rules, such as Read(./.env), stopped covering the project after a folder change with cd. They now also apply in added folders.
Other fixes concern deny and ask rules with the mcp__plugin_ prefix, which did not intercept servers or tools written with different capitalization. Deny rules were also not applied to an approval arriving after a restart, in sessions on self-hosted runners, and in remote-control.
Which permission and privacy bugs were closed?
A .claude/settings.local.json file mistakenly committed to the repository could be treated as the user's personal setting when Claude Code started in certain subfolders. We already covered settings files in this in-depth piece.
On Amazon Bedrock, token counting sent the conversation to the service even when the managed allowedProviders setting did not allow it. Background sessions started with claude.ai login could use, and bill, an API key or a shell token from the process that launched the service.
The /feedback and /bug commands now upload other sessions only if they were recorded by the connected account or organization. An allowed-tools setting for a slash command no longer extends to background agents woken up later.
What changes for MCP servers and background tasks?
The MCP part is the largest. A server remained in authentication-required state, with mcp_tool hooks skipped, after a token renewal was rejected for just an instant. Elicitation requests were cancelled without asking in headless mode after the connection was replaced.
Calls from SDK hosts answered "Not connected" after a reconnection. An MCP task could hang if the question was closed with Esc. The footer now indicates that your input is needed, and Enter in /tasks brings the question back up.
The question from a background task no longer opens above the message you are typing. It waits until you send or clear the draft. Similar fixes affect the Atlassian, Asana and Sentry connectors in cloud sessions, where they were being reported as failed even though they worked.
For news on Code Mode and MCP tasks, see our coverage of 2.1.323.
Which session, model and login problems were sorted out?
On models, subagents with their own model were switched to the plan mode model if the setting was opusplan or haiku. Those on another model sized file reads and MCP results using the main session's model. On many third-party gateways and on Foundry, sessions stopped with a context length error on every turn instead of compacting. On the gateway topic, we also recall the 2.1.319 release.
On login, claude auth status and other short commands left a lock on a Console profile, and the next session hung for about a minute. Pressing Esc right after the browser step in /login replaced the existing login. The accumulating .oauth_refresh.lock.owner.tmp.* files were also removed.
Among minor fixes, /stats counted one extra active day and /insights wrote two values into the HTML report without escaping.
Limits to know
The release notes do not explain the zstd flaw. We do not know which earlier versions were affected or whether there was any abuse. Many entries are described briefly, and only testing your own workflow will show whether they concern you. The list in the source is also truncated, so some of the latest fixes are not reported here.
What changes for those working in digital
If you use Claude Code in a team, update and recheck your deny and ask rules. Anyone who had relative rules after a cd may have had narrower coverage than expected. Those working behind gateways or with Bedrock get fixes to context and data flow. Anyone running a self-hosted runner should verify behavior after restarts. The OpenTelemetry telemetry is also more complete, with the user_prompt event for messages sent during tool calls.
Our take
A release with so many fixes on permissions and data flows shows that the tool is now an infrastructure component, not a terminal toy. It is good that the fixes are listed precisely, but the line on the zstd flaw is too stingy. Those who manage systems would at least like to know which versions are exposed. Until a dedicated security advisory appears, the rule remains to update soon and not to rely on blocking rules alone.
Frequently asked questions
What does Claude Code 2.1.325 fix?
It fixes a security issue in zstd decoding and dozens of bugs. They concern permissions, sessions, login, MCP servers, telemetry and the interface.
Is the zstd flaw serious?
We do not know. The official notes mention it in a single line, without severity, affected versions or exploitation details.
Do deny rules work better now?
Yes, in several cases. Relative rules stay valid after a cd, rules with the mcp__plugin_ prefix ignore case, and deny rules apply after a restart on self-hosted runners.
Does anything change for Amazon Bedrock?
Yes. Token counting no longer sends the conversation to Bedrock when the allowedProviders setting does not permit it.
Should I update right away?
Usually yes, especially if you use Claude Code in a team or on servers. The security fix and the permission fixes are reason enough.
What to expect after 2.1.325 on security
The release pace remains high and permission fixes are frequent. It is worth following what Anthropic says about the zstd flaw.
- Check whether Anthropic publishes a security advisory listing the versions affected by the zstd flaw.
- Read the notes of upcoming releases looking for entries on permissions and deny rules, as in 2.1.314.
- Verify in your OpenTelemetry logs that the user_prompt event with delivery.mode mid_turn arrives as expected.
