Claude Code 2.1.275-276: a broken gateway, fixed a day later, and npm locked down

Claude Code's 2.1.275 and 2.1.276, released September 17 and 18, 2026, are really one story. 2.1.275 fixes a gateway bug, then introduces a new one that breaks every request for some proxy setups, and 2.1.276 patches that the next day. In between, a solid batch of security fixes: credentials that were leaking into plugin logs, npm install scripts now blocked at install time, and a permission rule that /update-config wrote but Claude Code never actually read. Here's what matters.

One gateway fixed, another broken, patched the next day

2.1.275 fixes a bug that broke every turn with a 400 error for anyone behind a network gateway that rewrites API error responses, whenever the gateway rejected a beta request header. A real fix if you work behind that kind of infrastructure.

Except the same release introduces a regression elsewhere. ANTHROPIC_BASE_URL is the variable that points Claude Code at the gateway your organization runs, a third-party or in-house product rather than Anthropic's own Claude apps gateway, which is configured through its own settings. 2.1.275 broke that exact path: any request routed through a proxy or gateway configured via this variable failed with a 400 error naming an unrecognized advisor_20260301 input tag. 2.1.276, released the next day, fixes only that.

If you upgraded to 2.1.275 on September 17 and run behind a gateway, you likely had a broken day. The practical takeaway: aim for 2.1.276 directly, not 2.1.275 on its own.

Security: leaked credentials, npm install scripts now blocked

Two distinct security changes land in 2.1.275. The first is about plugins: when a command like claude plugin marketplace list, or a plugin error message, needed to display a git, ssh, or marketplace address, a password or token embedded in that address could show up in plain text. If you share a session log or a screenshot after configuring a private marketplace with credentials baked into the URL, this one is for you directly.

The second covers installing plugins distributed through npm. Until now, adding a plugin from an npm package meant running whatever code that package shipped in its preinstall or postinstall scripts, same as any npm dependency. The plugin sources doc now spells out the new behavior directly: "The package's install scripts, such as preinstall or postinstall, never run, and its dependencies aren't installed during the fetch." Claude Code now fetches the package with npm pack --ignore-scripts and verifies its integrity, closing a classic entry point for malicious code hidden inside a third-party plugin. If an MCP server bundled in an npm plugin needs other packages, it can launch through npx, which installs them on first run.

Permissions: a rule /update-config wrote that Claude Code never read

The permissions doc is blunt about something easy to miss: "Claude Code checks file permissions against Edit(path) and Read(path) rules only. If you write a path rule for Write, NotebookEdit, Glob, or the legacy MultiEdit tool instead, Claude Code accepts the rule but never consults it, and warns at startup." A Write(docs/**) rule in your settings does literally nothing: it's accepted, stored, never checked, and all you get is a startup warning.

The bug fixed in 2.1.275 is that /update-config was generating exactly that kind of useless rule: asking it to block writes to docs/ produced Write(docs/**) instead of Edit(docs/**), the only form the permission checker actually consults. If you used /update-config to lock down a path against writes before this version, go check the rule it generated. It may never have protected you.

Bash under zsh: the sandbox reported success on commands that had failed

The Bash sandbox "lets Claude run most shell commands without stopping to ask permission," confining what each command can touch at the operating-system level, files and network alike. What 2.1.275 fixes is different: on Linux, a sandboxed command run inside a zsh shell reported exit code 0, success, even when the command had actually failed. Any script or hook checking $? after a Bash command Claude Code ran could believe a success that never happened. The bug was specific to zsh, not bash, and only in sandbox mode on Linux.

Skills and plugins from your claude.ai account, now synced to the terminal

Not a fix, a new default: skills and plugins you've enabled on your claude.ai account now sync automatically into terminal sessions signed in with that account. The settings reference describes what syncClaudeAiSkills: false opts you out of: "Stop loading the skills enabled on your claude.ai account and stop downloading new ones." The same applies to plugins with syncClaudeAiPlugins: false. If you juggle multiple accounts, or don't want a terminal silently pulling in whatever you enabled elsewhere, these two settings are worth knowing about.

Everything else, briefly

• Claude apps gateway sign-in now shows the account the gateway names, for you to confirm before the credential is saved, and /status shows it afterwards. /logout also ends the session on gateways that advertise token revocation.
• A send-now key (ctrl+enter, or ctrl+x ctrl+s) interrupts the current turn and sends every queued message at once.
• /plugin install <plugin> --marketplace <source> now offers to add the marketplace before installing the plugin, in one command.
• claude plugin marketplace update no longer deletes a GitHub marketplace's local copy when the fetch fails and the marketplace is named after its repository.
• Fullscreen mode no longer freezes or blanks for several seconds when scrolling up past a large file diff.
• Several resume crashes and hangs are fixed: malformed transcript entries, Grep/Glob searches hanging past the 20MB output cap, /rewind restoring a truncated file in a forked session.
• Pasted and attached images are now saved where Claude can reopen them as files without a permission prompt, including in Desktop and VS Code.
• Claude in Chrome, in auto mode, now skips the extension's per-site check for calls the classifier already approved, the way bypass mode already does, fixing a browser_batch "Permission denied" error after a redirect.
• VS Code, Claude Code on the web, Claude Tag, and Code Review share roughly thirty more fixes between them, mostly display bugs and session edge cases.

What to take away

If you only remember one thing: don't stop at 2.1.275 if you run behind a network gateway, 2.1.276 fixes a regression that release introduced itself. Everything else follows a pattern that's been building for several releases: plugin security keeps improving in concrete ways, with npm install scripts now blocked and credentials no longer leaking into logs, and permissions gain one more case where the promise didn't hold, this time a rule /update-config generated that did nothing at all. The zsh exit-code bug deserves a separate check if you rely on $? in hooks or CI scripts driven by Claude Code.