Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.193 Home All releases ←olderv2.1.191 v2.1.195newer→
Claude Code v2.1.193

Workflow VM Boundary Security

What

Values crossing the workflow VM boundary now pass through a security-hardened sanitizer that runs inside the VM context itself, protecting against Proxy-based escape attacks.

Details
  • The sanitizer uses a WeakSet for cap-error identity (cannot be faked by an attacker-controlled Proxy whose get-trap returns true for any key).
  • Arrays are length-capped at a maximum count; exceeding it throws with "array length N exceeds the maximum of N supported across the workflow VM boundary."
  • Functions on crossed values are stripped to undefined.
  • Workflow results cannot be functions; attempting this now throws "workflow result cannot be a function."
Evidence

New in-VM sanitizer (search for "workflow VM boundary" or "workflow result cannot be a function")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.193 →