Claude Code 2.1.267: two security gaps closed, prompt cache stabilized

Claude Code 2.1.267 shipped on September 9, 2026, a day after the 2.1.265-266 double release covered in the previous digest. The throughline hasn't changed: more security hardening, this time on two checks that let through what they were supposed to block, plus a quieter push to keep the prompt cache intact when a session resumes after a break, a model switch, or an MCP reconnect.

A marketplace path with a backslash repeated the same bug

2.1.265 had already closed a way to bypass the symlink containment check during plugin loading on macOS and Linux, when the path contained a backslash. 2.1.267 fixes the same family of bug one step earlier in the process: this time it's the path declared by a marketplace entry itself, before a plugin is even installed, that could bypass the containment check on those two platforms through a backslash.

The plugin marketplaces docs are explicit about what this check protects: a path that resolves outside the plugin directory, something like ./../shared.md, is rejected, and Claude Code copies installed plugins into a cache location precisely so they can't reference files outside their own directory. Backslash isn't a path separator on macOS or Linux, but the check apparently treated it as one, letting through a path that the filesystem's actual resolution read differently. Two releases, two different entry points, the same reasoning gap about path characters. If you author or distribute marketplaces or plugins, there's nothing to do, the fix is transparent, but the repeat is worth knowing about.

Settings that allowed everything once they became unreadable

Three managed settings govern what an organization's hooks and channels are allowed to do: allowedHttpHookUrls restricts which URLs HTTP hooks can contact, httpHookAllowedEnvVars restricts which environment variables can be interpolated into their headers, and allowedChannelPlugins restricts which plugins may register as a channel, meaning push messages into an open session. The hooks docs spell out that the first two work as allowlists: once set, only what they explicitly list gets through. The third replaces Anthropic's own list with the organization's, on the same principle.

The bug 2.1.267 fixes hit the case where the managed settings file carrying these values became unreadable, malformed JSON or a read error. Claude Code fell back to permissive behavior, as if the setting had never been defined, instead of defaulting closed. For an organization relying on these allowlists to stop a hook from leaking a sensitive variable to an unapproved URL, a config error that swings the door open instead of shutting it is the worse of the two failure modes. The fix now fails closed in all three cases: an unreadable setting no longer allows anything.

The prompt cache, this release's other project

About a dozen fixes in 2.1.267 all target the same mechanic: keep the prompt cache intact, on resume and mid-session alike, instead of recomputing it for no reason. The prompt caching docs lay out the principle: a change anywhere in a request's prefix, system prompt, tools, or history, invalidates everything after it, and rebuilding that prefix costs one slower, more expensive turn.

Among the fixes: resuming a session after /compact or a slash command via -p --resume no longer inserts a spurious "Continue from where you left off" turn; resuming a session whose recorded transcript exceeds 5MB no longer drops parallel tool calls or their hook output; a tool that disappears mid-conversation, from a disconnected MCP server or an upgrade, no longer rewrites the whole tool list and discards reasoning already produced; and switching models with /model no longer resends every tool definition, with commit and PR attribution text now arriving as a conversation note that updates on each model change. None of this changes a command or a habit, it's session resume getting back to being as fast and as cheap as it should be, most noticeable if you chain long sessions you pick back up day to day.

An effort cap for organizations

New maxEffortLevel setting, configurable globally or per model under modelSettings, caps the effort level available on a model across every provider, Bedrock, Vertex, and Foundry included. Users can still pick a lower level themselves, it's a ceiling, not a forced value. The use case matches the other cost controls already available: an organization that wants to stop maximum effort from driving up a team's bill without anyone having agreed to it. Alongside it, --system-prompt-snapshot off forces the system prompt to render fresh on every request instead of reusing the one recorded at session start, useful if you're iterating on a custom system prompt and want every change reflected immediately.

Everything else, briefly

• Cowork: scheduled tasks in the cloud no longer fail at startup for organizations whose managed settings require sandboxing.
• Mobile: /context and other local command output no longer render blank on mobile clients.
• Terminal: shift+enter and option+backspace work again after reconnecting to a tmux or ssh session inside an agent view.
• Remote Control: claude remote-control no longer exits and drops every attached session when its server credential expires, roughly 30 days after start; the host re-registers and keeps going.
• Expired AWS or Google Cloud credentials under a host app like Claude Desktop: the re-authenticate error now shows directly, instead of ten generic retries first.
• Claude Code on the web: GitHub Enterprise Server sessions no longer show your GitHub account as disconnected once its token expires, and gh calls now work in organizations without the Claude GitHub App by using your connected GitHub account.
• VS Code: eight fixes, including a 100% CPU hang tied to a cyclic parent link in a saved conversation, broken screenshot pasting on WSL2, and diff blocks that always rendered with a dark theme instead of following the editor's active one.
• Claude Tag: a link to switch to a custom connector without starting over, and a clearer error message when the organization has run out of usage credits.

The takeaway

If you're a solo user on a regular claude.ai account, nothing here changes your habits: the marketplace fix matters to plugin authors and distributors, the allowlist fix to organizations deploying managed settings, maxEffortLevel targets those same organizations on the cost side, and the batch of prompt-cache fixes simply works in your favor with nothing to configure. The pattern from the previous release holds: two releases running, it's the same plugin path containment check that needed patching again.