10 September 2026claude-code#claude-code#release#plugins#security#automation

Claude Code v2.1.265–v2.1.268: safer gateways, steadier caches, and scriptable plugins

Four releases add folder-based plugin loading and effort caps, repair gateway and third-party API regressions, and tighten permission, secret, and prompt-cache handling.

Claude Code v2.1.265–v2.1.268, published September 8–10, 2026, is a practical update for teams running plugins, gateways, resumable agents, or unattended jobs. The sequence matters: v2.1.265 introduced useful plugin and session changes, v2.1.266 immediately repaired a gateway-auth regression, v2.1.267 added effort-policy and system-prompt controls, and v2.1.268 fixed another compatibility regression while tightening several security boundaries.

The operationally important changes

Plugin bundles are easier to develop and automate. --plugin-dir can now point to a parent folder, and Claude Code loads each child folder that contains a plugin manifest. v2.1.268 also adds --json output to the plugin install, uninstall, update, enable, and disable commands, which gives CI and fleet tooling a supported machine-readable path.
Gateway and proxy users should skip v2.1.265. That release made the undocumented CLAUDE_CODE_USE_GATEWAY variable force Claude apps gateway sign-in on its own. Setups using an API key, apiKeyHelper, or custom auth headers could fail every request. v2.1.266 restores the previous behavior, while v2.1.268 also fixes HTTP 400 failures that affected third-party Anthropic-compatible endpoints after v2.1.265.
Administrators can cap effort. maxEffortLevel, set globally or per model under modelSettings, limits the highest effort users can select across Anthropic and third-party providers. Claude Code applies the lowest cap across settings scopes, so a less restrictive local setting cannot widen a managed limit.
Prompt iteration can opt out of snapshots. --system-prompt-snapshot off rebuilds the system prompt on every request instead of replaying the prompt recorded with the conversation. That is useful while iterating on prompt flags across --continue runs; the default recorded prompt remains the cache-friendly choice for normal sessions.
Prompt-cache continuity received a broad repair pass. The releases stabilize tool definitions and prompt prefixes across resumed sessions, model switches, connectors, background workers, subagents, and Agent SDK configurations. These fixes target accidental cache misses and cases where earlier extended thinking could be dropped when tool definitions changed.

Security and reliability details

v2.1.268 closes several disclosure and permission gaps. Plugin and marketplace errors no longer display credentials embedded in Git source URLs, and MCP status or error views no longer reveal secrets resolved from ${VAR} placeholders. Deny and ask rules now apply consistently when symlinked paths are addressed through their resolved locations, and opaque shell constructs such as env -C or eval no longer let a same-line file operation bypass a deny rule.

The release also gives WebFetch a 300-second deadline for responses that never finish. Operators can change it with CLAUDE_CODE_WEBFETCH_DEADLINE_MS, including 0 to disable the deadline. Self-hosted environment operators gain the --remove-session-state runner flag to delete per-session directories when sessions end, while gateway operators can distribute contracted pricing through managed settings and receive warnings when inbound CIDR controls are empty.

One compatibility change deserves attention in model-pinned automation: task-tracking tools are now offered by default only to Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6, and Haiku 4.5. Other models require CLAUDE_CODE_ENABLE_TODO_TOOLS=1. Test workflows that depend on TaskCreate, TaskUpdate, TaskList, or TodoWrite before changing their model.

What to do

Upgrade to v2.1.268 or later, then test the paths your environment actually uses:

claude update
claude --version
claude auth status

For a gateway-backed fleet, run one request through the same authentication and endpoint configuration used by CI. For plugin automation, exercise the new JSON output before changing parsers. If your runners depend on task-tracking tools or long-lived resumable sessions, verify those behaviors with the production model and managed settings rather than assuming a successful interactive launch covers them.

Official Claude Code v2.1.265 release notes · v2.1.266 release notes · v2.1.267 release notes · v2.1.268 release notes · Claude Code CLI reference · settings reference