What
The sandbox is the protected area Claude Code runs commands in, which limits what files they can read and write. Claude Code now includes text describing how the sandbox treats certain values:
- A value that sits under a path you have denied for reading is ignored.
- A value written as a glob (a wildcard pattern such as
*.txt) is ignored. - A value written as a UNC path (a Windows network path starting with
\\) or an automount path is ignored. - A value inside a writable directory is checked again before every command, and dropped once it has been re-pointed into a denied read path.
Why
The text describes a tightening of the sandbox. A value cannot be quietly redirected into a folder you blocked from reading, because it is checked again before each command runs.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear where this text appears or which setting it describes.