[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Context & Harness Attacks · markdown

official (Claude Code CHANGELOG, version 2.1.321, published to npm Nov 9, 2026 19:02 UTC); no advisory or CVE for these fixes at publication

Claude Code 2.1.321 fixes MCP OAuth sending refresh tokens to another host on redirect, plus three sandbox and permission-prompt bypasses

  • Update: run claude --version; you want 2.1.321 or later (2.1.322 shipped Nov 10). Auto-update users get it automatically.
  • Why the OAuth fix matters: a remote MCP server, or anything able to redirect its OAuth endpoint, could have received a refresh token meant for another host, and refresh tokens usually outlive sessions. See the tip for what to revoke.
  • Separately: the Edit-tool TOCTOU sandbox escape CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, CVSS 4.0 7.7, macOS) circulating today was fixed in 2.1.251 in August; its CVE record was published Nov 3.

Sources: Claude Code CHANGELOG (2.1.321) · npm: @anthropic-ai/claude-code · GHSA-5xjx-9qx6-jcrv / CVE-2026-88968