Claude Code 2.1.187 Changelog: sandbox.credentials Blocks Secret Access, Org Model Restrictions Hit All Entry Points

Claude Code 2.1.187, released June 23, 2026, ships two governance changes that every operator running enterprise or team deployments needs to evaluate before rolling out the update. This release follows a series of governance-focused updates tracked in the TheRouter news section: sandbox.credentials blocks sandboxed commands from reading credential files and secret environment variables, and org-configured model restrictions now enforce consistently across the model picker, --model flag, /model command, and ANTHROPIC_MODEL environment variable. The release also fixes several reliability issues that affect multi-agent and gateway deployments directly.

What changed in 2.1.187

sandbox.credentials — new credential isolation control:

Added sandbox.credentials setting to block sandboxed commands from reading credential files and secret environment variables

The sandbox already provides filesystem and network boundary enforcement for Bash commands. sandbox.credentials adds a distinct policy layer: even within an otherwise-permitted filesystem scope, sandboxed commands cannot read credential files (SSH keys, .env files, AWS config, service account tokens) or secret environment variables when this setting is enabled. This closes a gap that previously required careful manual path exclusion from sandbox allow-lists.

Org model restrictions reach all entry points:

Added org-configured model restrictions to the model picker, --model, /model, and ANTHROPIC_MODEL, with a "restricted by your organization's settings" message when a restricted model is selected

Model governance configured by organizations in managed settings now propagates uniformly. Previously, a developer could bypass an org restriction by passing --model at invocation time or setting ANTHROPIC_MODEL in the environment — neither honored the org policy. In 2.1.187, all four entry points (picker, CLI flag, slash command, env var) check and enforce org restrictions, surfacing a clear "restricted by your organization's settings" message on violation.

MCP idle timeout fix — 5-minute hangs resolved:

Fixed remote MCP tool calls that hang with no response for 5 minutes — they now abort with an error instead of blocking indefinitely (override with CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT)

Operators running Claude Code with remote MCP servers — tool registries, data connectors, code execution hosts — have reported sessions hanging for exactly 5 minutes when a remote tool call receives no response. The fix aborts these calls with an error on timeout rather than blocking indefinitely. The timeout is configurable via CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT for environments where longer waits are acceptable.

Subagent depth tracking fix:

Fixed subagent depth tracking: resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap

Teams running nested subagent architectures had a gap: resumed subagents would lose their spawn depth context (potentially escaping depth caps), and forked subagents were not counted toward the depth limit at all. Both are now enforced correctly. If your deployment relies on depth caps for governance — limiting how many layers deep an agent can spawn further agents — verify that caps are still set appropriately after the fix.

Leaked agent worktree cleanup:

Fixed leaked agent worktree registrations: locked .git/worktrees/ entries from killed agents are now cleaned up automatically

Long-running agent deployments with frequent agent restarts or forced terminations would accumulate stale .git/worktrees/ entries, causing git operations to fail with locked worktree errors. Cleanup is now automatic on agent startup, removing orphaned entries from previously killed sessions.

Why this matters for AI engineering teams

sandbox.credentials is the most important new control for enterprise deployments. The Claude Code sandbox limits which files and network domains sandboxed Bash commands can reach — but without explicit credential path exclusions, a sandboxed agent could still read .env files, SSH private keys, or AWS credential files within a permitted directory. sandbox.credentials provides a categorical policy: secrets are off-limits regardless of path scope. For any team running Claude Code against codebases that co-locate credentials with source files, this setting closes a meaningful attack surface.

The org model restriction gap was a real governance hole. Compliance teams that had configured model restrictions in managed settings often assumed those restrictions were comprehensive. In practice, a developer aware of the env var bypass could override restrictions by setting ANTHROPIC_MODEL in their shell profile or passing --model in a script. 2.1.187 closes all four bypass paths with uniform enforcement and a user-visible error message.

MCP hang fixes directly affect gateway reliability SLAs. A 5-minute hanging tool call cascades into: session timeouts, blocked agent turns, and misleading session states in observability tools. For routing layers that meter session duration or track tool call latency, a hung MCP call inflated metrics and degraded user experience silently. The fix surfaces the failure clearly, enabling proper fallback handling at the gateway layer.

The router/operator angle

sandbox.credentials for multi-tenant environments: Operators hosting Claude Code for multiple teams share infrastructure where credential files from different tenants may coexist in project directories. Enabling sandbox.credentials organization-wide via managed settings prevents cross-tenant credential leakage through sandboxed bash execution, without requiring per-project sandbox allow-list tuning.

Model restriction enforcement and cost allocation: When org model restrictions are enforced uniformly, cost allocation models become more reliable. If your organization has configured specific models per team or project for billing purposes, prior bypass paths through --model or env vars created mismatches between intended and actual routing. 2.1.187 makes the enforcement comprehensive, so cost attribution via OTEL or usage reports will correctly reflect the org-configured model paths.

MCP timeout governance: The new CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT env var gives operators fine-grained control over how long Claude Code waits for a remote MCP tool call before aborting. For gateway operators routing to multiple MCP servers with different reliability profiles, setting aggressive timeouts on lower-reliability servers while allowing longer waits for high-latency but reliable servers enables differentiated reliability policy without code changes.

Subagent depth caps for agentic cost control: Depth caps limit how deeply an agent swarm can recursively spawn sub-agents. Before the fix, resumed and forked subagents could escape these caps. For teams using depth caps as a cost control mechanism — preventing unbounded recursive spawning during long-horizon tasks — the fix makes the cap enforcement reliable. Review your configured depth limits after updating to confirm they still match your cost and governance intent.

What to audit before updating to 2.1.187

1. Enable sandbox.credentials in managed settings for any org where Claude Code sessions operate on codebases with co-located credential files. Verify that legitimate tooling that legitimately needs credential access is explicitly authorized via other sandbox configuration paths.

2. Audit org model restrictions for completeness. Now that all four entry points enforce restrictions, confirm the configured model list reflects your current billing, compliance, and capability intent. Restrictions that were set but partially bypassed previously will now be fully enforced — developers who relied on --model overrides will see the restriction error message.

3. Set CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT for remote MCP servers with known latency profiles. The default abort behavior is a better failure mode than indefinite hang, but operators with high-latency reliable servers may need to extend the timeout.

4. Review subagent depth cap settings. Forked and resumed subagents now count toward depth caps. If caps were set with the assumption that forks and resumes were exempt, current caps may be more restrictive than intended. Adjust accordingly.

5. Verify worktree health. On first startup after update, Claude Code will automatically clean up stale .git/worktrees/ entries. For long-running deployments with many prior sessions, this cleanup may take a few seconds. Monitor logs if startup latency is a concern.

Update via npm install -g @anthropic-ai/claude-code or your managed deployment path. Run claude --version to confirm 2.1.187.

What TheRouter users should watch

Teams routing Claude Code requests through TheRouter benefit directly from the MCP timeout fix: tool call hangs that previously propagated as silent session stalls will now surface as clean errors with response codes that routing policy can handle. If you operate a multi-tenant Claude Code deployment on TheRouter, consider enabling sandbox.credentials in your managed settings configuration and reviewing the TheRouter docs for updated governance documentation and integration guides as Anthropic publishes them. For broader context on how coding agent releases affect routing decisions, see the TheRouter news section.