Claude Code 2.1.274: four permission blind spots closed in one release

Claude Code 2.1.274, out September 17, 2026, closes four separate permission and security gaps: two more in the Bash command checker, one in the Edit tool's approval preview, and one in how MCP servers handle secrets. The rest of this roughly hundred-entry release is mostly MCP reliability fixes and background-session cleanup, plus about thirty interface bugs split across VS Code, Claude Code on the web, Claude Tag, and Code Review. Here's what actually matters.

Bash: two more blind spots in the permission checker

2.1.274 continues a run started in the previous releases, where four blind spots were closed on September 14 and two more the next day. The permissions doc explains why these edge cases keep surfacing: the checker has to read a Bash command as written and decide whether it needs confirmation, before it ever runs. The permission modes doc puts it plainly: "A command the shell parser can't trace, such as one that changes directory more than once or runs a subshell, prompts the same way even when it names no outside path." Every unusual shell construct is one more case the checker has to cover explicitly.

This time, two specific constructs slipped through. First, commands that loop over certain special shell variables, or assign to them, skipped the permission prompt entirely; they now ask. Second, a worktree-isolated session, the kind Claude Code uses to keep an agent's file changes scoped to its own git worktree, could accept a Bash command containing certain nested shell expansions; those commands are now refused outright.

The two fixes don't reach the same people: the first applies to any session that counts on the Bash permission prompt, the second only to worktree-isolated ones. Either way, it's exactly the kind of command that could reach outside a boundary you thought was closed.

Edit: the approval preview could show a different location than the real edit

The permissions table notes that in Manual mode file edits require confirmation, precisely so you can see what you're approving before it applies. 2.1.274 fixes a case where that promise didn't hold: in files containing multi-byte characters, the preview shown in the Edit tool's permission prompt could point to a different location than where the edit actually landed once approved.

It's the kind of bug that breaks nothing visibly unless you compare the preview to the result, but it undercuts the one protection Manual mode gives you here: reading before accepting. Under acceptEdits there's no prompt to read in the first place for a file inside your working directory. And the trigger is nothing exotic: an accented character, a Japanese string or an emoji anywhere in the file makes it a multi-byte file. If you approve edits on the strength of the preview alone, this release restores what you already assumed was true.

MCP: a connection error shouldn't print your secrets

The MCP doc documents ${VAR} expansion in server configuration, for the URL, headers, arguments, or environment variables passed to the server. It also spells out an existing protection for sensitive credentials: "In a remote server's url and headers, Claude Code reads credential variables from your environment as empty rather than expanding them. This keeps a project's .mcp.json or a plugin from sending your Claude Code or cloud provider credentials to a server it names."

The bug fixed in 2.1.274 hit two different paths: when a connection to an MCP server failed, the error message shown could display the resolved value of a ${VAR} placeholder, secret included, instead of masking it. The MCP login tool's description did the same. The expansion guard still holds for known Claude and cloud provider credentials, but a secret stored in a custom environment variable, an API key for a third-party server, for example, could end up printed in plain text in an error message, and from there potentially in a log or a session screenshot. If you configure remote MCP servers with custom authentication headers, make sure you're running this version.

Everything else, briefly

• A visible warning now appears when memory usage gets critical, with steps to free memory up or restart safely.
• http-type MCP servers that only speak legacy HTTP+SSE connect again when they answer the first request with a 422 or another 4xx, and Streamable HTTP tool calls no longer time out after about 5 minutes despite a longer per-server timeout.
• Sessions that got stuck endlessly retrying after an "unexpected tool_use_id" 400 error now end cleanly instead.
• Hook-driven sessions, an active /goal for instance, no longer end on "Prompt is too long": they compact the conversation as intended instead of failing outright.
• claude agents no longer drops --model, --effort, --permission-mode, and other flags after an automatic update.
• The first turn of a cloud session no longer occasionally starts without the tools of an SDK-hosted MCP server that was still connecting.
• Headless and SDK sessions no longer trigger a separate model call for every background task that finishes, which was quietly inflating their cost.
• "type": "sdk" MCP entries in .mcp.json, settings, plugins and agent files are now skipped with a warning: only an SDK host application can register an in-process server.
• Bedrock, Vertex, Foundry and telemetry-disabled installs now default to the v2 MCP client and MCP 2026-07-28 negotiation with direct HTTP servers, as other installs already did. Opt out with MCP_SDK_GENERATION=v1 or MCP_PROTOCOL_NEGOTIATION=legacy.

The bottom line

If you take one thing from this release, it's that security and permissions remain Claude Code's most active area of work, release after release: two more Bash blind spots, an edit preview that could lie about what it was approving, and a real secret-leak risk in an MCP error. Three of the four needed nothing exotic to reach you: an accented character in a source file was enough for the edit preview, a custom authentication header for the MCP leak. Only the nested-expansion case assumes a specific way of working, the worktree-isolated session. Everything else, MCP reliability and background-session cost, improves day-to-day use without changing how you work.