Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.163 Home All releases ←olderv2.1.140 v2.1.165newer→
Claude Code v2.1.163

Workflow VM Security Hardening

What

The workflow VM execution environment was substantially hardened against Proxy-based attacks that could cross the JavaScript VM sandbox boundary.

Details
  • Arrays crossing the VM boundary are now deep-cloned inside the VM sandbox. The array length is read once (preventing a Proxy length getter that increments from causing an infinite loop on the host thread).
  • The maximum array length crossing the boundary is capped; exceeding it throws a clear error rather than hanging.
  • Functions are never cloned across the boundary (they become undefined).
  • A private _CAP symbol on boundary-cap errors prevents hostile Proxy traps from intercepting and suppressing the error.
  • The budget object passed to workflows now uses __proto__: null to prevent prototype chain pollution.
  • agent, parallel, pipeline, workflow, and args are injected into the VM context via Object.defineProperty with proper wrapping rather than being in the initial context literal.
  • The args value is serialized with JSON.stringify/JSON.parse through the VM context to prevent host-side Proxy objects from being accessible inside the script.
Evidence

Cross-VM clone code (search for "array length is not a safe integer across the workflow VM boundary")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.163 →