What changed
Anthropic's immutable Claude Code 2.1.299 release adds configurable idle compaction, file-mention path-only mode and managed-mod access to prompt attachments and session identity, while fixing sandbox writes into executable plugin folders, stale remote plugin unloading and scheduled wakeups during background work.
Why it matters
The release both expands what organization-managed extensions can observe and closes paths where sandboxed commands or stale plugin code could affect trusted execution. Teams now have concrete attachment, identity, plugin-lifecycle and long-session boundaries to retest.
What to do
Canary 2.1.299 with synthetic attachments and identities. Confirm only approved managed mods receive media bytes, attempt a sandboxed write into every plugin directory, disable a plugin remotely between turns, and verify scheduled wakeups plus idle compaction without losing the active task.
Caveat
These are Anthropic release claims, not an independent security assessment. Managed mods can receive sensitive prompt media and identity data, while idle compaction can change long-session behavior; exact enterprise policy and plugin configurations still need local tests.