When policy-helper settings arrive via remote managed settings, helper paths that are UNC paths, network-automount paths (/net, /Network/Servers), or kernel magic-link paths (/proc, /dev/fd) are now rejected outright. Inline scripts delivered this way are refused entirely, and any claudeMd field found inside a remote-delivered managedSettings payload is deleted before use.
Remote-delivered managed settings get stricter path and payload rules
Remote-delivered managed settings now reject risky helper paths and inline scripts, and strip claudeMd
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
ImprovementsKind: in v2.1.235,
ImprovementsSection of the release