Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Internal ChangesKind: in v2.1.261,
Internal ChangesSection of the release
The file_upload tool's path-safety checks, covering network path rejection, Windows-path spoofing detection, percent-encoding/.. rejection, and kernel alias-namespace rejection (paths like /dev, /proc, ..namedfork), are now factored into shared helper functions. These are applied both to a new lightweight pass-through validation path and the existing full resolve-and-check path, tightening protection against path traversal and spoofing when Claude-in-Chrome uploads local files.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude…
