Hey guys, Mr. Technology here.
Anthropic shipped Claude Code v2.1.265 on September 8, 2026 at 20:37 UTC, followed 3 hours 18 minutes later by v2.1.266 at 23:55 UTC as a targeted regression fix. v2.1.265 is the larger of the two: the release notes list roughly fifty items spanning new capabilities, security fixes, operational reliability fixes, and one privacy-relevant telemetry change. v2.1.266 is a single-item hotfix. For a builder who pins Claude Code in CI, in unattended agents, or in shared dev environments, v2.1.265 is the release to read end-to-end before bumping; v2.1.266 is the release to confirm you're on if v2.1.265 broke your setup.
This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.265 / v2.1.266 release notes. I have not installed either release in a production harness; treat the operational, security, and privacy claims as documentation comparison, not firsthand test. (anthropics/claude-code: Release v2.1.265, Release v2.1.266)
v2.1.265 is unusually broad. I have grouped the items by what they do; every quote below is from the release notes.
Per the release notes: "Added user.email and user.groups to the telemetry Claude Desktop and Cowork send through a Claude apps gateway, matching terminal sessions."
Claude Desktop and Cowork clients that route their traffic through a Claude apps gateway now include user.email and user.groups in their telemetry stream. Terminal (Claude Code CLI) sessions were already sending these fields; v2.1.265 brings Desktop and Cowork to parity. For a developer running Claude Code from the terminal inside an enterprise that proxies through a Claude apps gateway, the telemetry payload from their session is unchanged. For a developer using Claude Desktop or Cowork for the first time through a gateway, their email and group memberships now leave the client as part of normal telemetry. This is the single privacy-relevant change in v2.1.265 and the reason it sits at the top of the article.
If your organization is subject to data-residency rules, GDPR data-subject categories, or HIPAA / FedRAMP scoping on what leaves the desktop client, this is the change to discuss with the security team. The data fields themselves are not new to Claude Code in general; they are new to Desktop and Cowork specifically when those clients are routed through a Claude apps gateway. Verify with your gateway admin whether user.email and user.groups are redacted at the relay boundary or forwarded as-is.
--plugin-dir now points at a folder of pluginsPer the release notes: "Added support for pointing --plugin-dir at a folder of plugins: each child folder with a manifest loads, and children added or removed while running are picked up."
The CLI flag --plugin-dir previously pointed at a single plugin directory. v2.1.265 extends it to point at a folder whose child folders are individually loadable plugins (each with its own manifest). Adding or removing child folders while Claude Code is running is now reflected live. For a team that ships a plugin catalog inside their monorepo — each plugin as a subdirectory under plugins/ — the workflow moves from "one plugin at a time, restart between" to "point at the folder, edit and add subdirectories without restart." For an enterprise with a managed plugin catalog, this is the multi-tenant load path.
Per the release notes: "Added a 1 GB cap on tool results saved to disk; the in-conversation preview says when a saved file was truncated."
Tool results that exceed the inline preview (and are saved to a file the model then reads back) now have a 1 GB hard cap on disk. The in-conversation preview notes truncation when the saved file is shorter than the source. For an agent that runs cat big-dump.json or generates a large artifact, the model is told up front when the on-disk file is incomplete, and the model can request a more selective read rather than silently consuming a partial file. For a CI agent that scrapes large logs, the cap is a defense against accidentally writing multi-GB output files to the project's tmp directory.
Three of the v2.1.265 fixes touch plugin path safety:
.something (two-dot prefix) was being refused as outside the plugin root even when it was inside. Closed — legitimate plugins load; the symlink-containment check is still enforced.For a developer shipping a plugin, the backslash bypass and the .something directory name fix together mean the plugin root containment model is now enforced consistently across macOS, Linux, and Windows-style path separators. The artifact-publish connector check is the most user-visible change: a developer who publishes artifacts through connectors will see warnings or refusals on misconfigured connector names.
Two prompt-cache reuse fixes ship in v2.1.265. Both are operational cost improvements, not security:
For a developer running multi-agent Claude Code — agent teammates, foreground-spawned subagents, background subagents — these two fixes are silent cache-hit improvements. The fix is invisible until you look at the cache-hit rate in the API telemetry or in /cost; before v2.1.265 the rate was artificially lower on subagent-heavy workflows. After v2.1.265, the rate should improve on workflows that previously looked cache-cold only because of the prefix drift. Anthropic's Fable 5.1 / Mythos 5.1 cache-hit rate of $0.25 per million tokens (0.025x) makes a cache miss materially more expensive than the older Sonnet 4.6 baseline, so this is a non-trivial cost improvement on long-running agent runs.
Per the release notes: "Fixed MCP servers configured as http that only speak the legacy HTTP+SSE transport never connecting; Claude Code now falls back to SSE as the MCP spec describes."
MCP servers configured with transport http that actually only speak the legacy HTTP+SSE transport were failing to connect in Claude Code. The fix adds the SSE fallback described in the MCP spec. For an agent that wires up an MCP server whose operator hasn't updated the transport declaration to match their actual implementation, this is the connect path that finally works. For an enterprise that ships an internal MCP registry with mixed transport declarations, this is the connect path that no longer silently drops servers.
Per the release notes: "Improved remote MCP servers that need sign-in: Claude Code no longer registers an OAuth client with them until you actually authenticate."
Remote MCP servers that require OAuth sign-in no longer get an OAuth client registered against them on first contact — registration is deferred until the user actually authenticates. For an agent that touches many remote MCP servers during a session, this is the OAuth hygiene fix: registration side-effects (audit logs, dashboard entries, sometimes per-server quotas) no longer fire on incidental contact. For a developer who runs Claude Code against a remote MCP catalog, the OAuth flow is also simpler — no half-registered client sits in the MCP server's dashboard from a failed or abandoned session.
Per the release notes: "Fixed the Claude apps gateway's OTLP telemetry relay pausing all forwarding to a collector for 30 seconds after it rejected a few payloads as malformed or too large."
A small number of malformed or oversized payloads from a collector used to put the relay into a 30-second silence for all collectors. v2.1.265 fixes the backpressure so one collector's rejection does not block the others. For an organization that runs multiple OpenTelemetry collectors behind the gateway, this is the observability-pipeline fix.
Per the release notes: "Changed Claude apps gateway sessions to export OpenTelemetry directly to a collector the gateway's managed settings name in OTEL_EXPORTER_OTLP_ENDPOINT, instead of through the gateway's relay; sessions without a named collector still use the relay."
Claude apps gateway sessions now export OpenTelemetry directly to a collector named in managed settings (OTEL_EXPORTER_OTLP_ENDPOINT). Sessions without a named collector fall back to the relay. For an enterprise that has named a specific OTLP collector in managed settings, the telemetry path skips the relay — fewer hops, fewer failure modes, lower latency on the collector side.
claude-api skill's error-code referencePer the release notes: "Fixed the claude-api skill's error-code reference: model access failures return 404 and unavailable beta headers return 400, not 403."
The claude-api skill (an in-CLI reference for API error codes) had 403 on what should have been 404 (model not found) and 400 (beta header not available). The reference is corrected. For a developer who uses the claude-api skill to debug API errors, the corrected mappings are the ones to consult now. Note that this is the skill's reference table, not the API itself — the API's actual status codes are documented on the platform.claude.com error-codes page.
cd now persists across turnsPer the release notes: "Fixed non-interactive sessions (-p with stream-json input, Agent SDK, cloud sessions) resetting the shell working directory at each new user message; a cd now persists across turns."
In -p non-interactive sessions, the Agent SDK, and cloud sessions, the shell working directory was resetting between user messages; cd directory && do_thing was failing because do_thing ran in the original cwd. v2.1.265 fixes the cwd persistence. For a CI agent that runs cd build && make across multiple claude -p invocations on the same process, this is the fix that makes multi-step shell workflows actually work.
Per the release notes: "Improved /workflows agent detail: tool calls are marked running, failed or done, the subagent's task list is shown when it has one, and Enter unfolds the listed calls with their inputs and results."
/workflows agent detail now shows tool-call status (running / failed / done), the subagent's task list when present, and unfoldable call inputs and results on Enter. For a developer running long-running workflows and checking progress, this is the observability surface that lets you see at a glance whether a subagent is stuck, failed, or making progress.
Per the release notes: "Improved slash commands typed mid-prompt: matches now show in a list (Tab opens it outside fullscreen) instead of a single suggestion, and a plugin skill is now found by its bare name."
Slash commands typed mid-prompt now show a list of matches rather than a single suggestion. Tab opens the match outside fullscreen mode. Plugin skills are found by their bare name (no slash-prefix required). For a developer using the TUI, the autocomplete surface is materially more usable.
Per the release notes: "[VSCode] Added automatic archiving of sessions inactive for a set period (new 'Archive inactive sessions' setting, default 14 days)."
The VSCode extension now auto-archives sessions that have been inactive for 14 days by default (configurable). For a developer who accumulates a lot of sessions in the sidebar, the auto-archive keeps the list manageable.
Per the release notes: "Windows: Fixed Read, Write and Edit refusing every file ('symlink resolution changed after permission was checked') when running inside an AppContainer or restricted-token sandbox."
Read, Write, and Edit on Windows in AppContainer or restricted-token sandbox mode were failing with a symlink resolution changed after permission was checked error on every file. v2.1.265 fixes the TOCTOU between permission check and symlink resolution under Windows sandboxing. For a developer running Claude Code inside a Windows enterprise sandbox, the file tools now actually work.
--worktree parallel checkout on large repositoriesPer the release notes: "Improved --worktree startup on large repositories: the new worktree is now checked out in parallel (git 2.32+)."
--worktree startup on large repositories now uses parallel checkout (requires git 2.32 or newer). For a developer working in a monorepo where --worktree startup was noticeably slow, the parallel checkout is the speed improvement.
The release also covers: a syntax-highlighting fix for Ruby ?, Erlang $, and Perl $ sigils in permission prompts and messages; a fullscreen transcript scroll fix when slash-command or @-file suggestion lists open; VS Code and SDK session re-login fixes; Remote Control end-of-turn signal ordering; background --bg session idle-timeout race; clean-filter git probes against nested repos; advisor tool re-decision consolidation; /add-dir agent-vs-skills managed-settings consistency; two-key keyboard shortcut cancellation timeout (3 seconds); forked skills context: fork streaming and --forward-subagent-text progress events; plugin component folder OS-uncertifiable errors reported in /plugin; /plugin Discover/Browse metadata fallback; /login re-run in managed-settings-gateway session; /model save-failure surfacing; /clear from Remote Control waiting on SessionStart hooks; /config tab-switch dialog height; workflow run resume after container restart; some claude.ai connectors in cloud sessions showing as needing auth when connected; remote sessions keeping sandbox container alive on connector approval; resumed sessions showing short model-facing recovery in background-task-didn't-finish notices; .claude folder permission wording; machines with forceLoginGatewayUrl becoming gateway sessions from startup; image processing using runtime built-in image support (no temp extraction); plugin display metadata preferring marketplace entry over plugin.json; VSCode sidebar chat blank-after-restart; VSCode timeline dot position on Remote Control active message. These are individually minor; together they are the reason v2.1.265 is a large release.
Per the release notes: "Fixed a 2.1.265 regression affecting LLM-gateway and proxy setups: the undocumented CLAUDE_CODE_USE_GATEWAY environment variable, previously ignored unless ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN were both set, began forcing Cloud-gateway sign-in on its own in 2.1.265, so configurations that set it alongside an API key, apiKeyHelper, or custom auth headers failed every request with 'Not signed in to the Cloud gateway'. The variable on its own is ignored again; no configuration change is needed."
The single-item v2.1.266 hotfix closes a v2.1.265 regression in the CLAUDE_CODE_USE_GATEWAY env var. Before v2.1.265, the undocumented variable was ignored unless both ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN were also set. v2.1.265 began forcing Cloud-gateway sign-in whenever the variable was set alone, which broke any setup that combined it with an API key, apiKeyHelper, or custom auth headers — every request failed with Not signed in to the Cloud gateway. v2.1.266 restores the original behavior: the variable on its own is ignored again. No configuration change is required; if you skipped v2.1.265 because of this regression, pin v2.1.266 and you're back on track. If you deployed v2.1.265 to a fleet and saw widespread "Not signed in to the Cloud gateway" errors, upgrade to v2.1.266 and they clear.
Six concrete shifts for builders running Claude Code in production:
1. Telemetry on the gateway now includes user.email and user.groups from Claude Desktop and Cowork clients. This is the privacy-relevant change. Terminal sessions were already sending these fields; Desktop and Cowork clients now match. For an enterprise with a Claude apps gateway, the data flow now includes end-user identity from any Claude client that routes through the gateway.
2. Plugins can now be loaded as a folder of plugins with live add/remove. --plugin-dir is now a multi-tenant load path, not a single-plugin path. Teams shipping a plugin catalog inside their monorepo move from "one plugin, restart between" to "point at the folder, edit live."
3. Tool results saved to disk are now capped at 1 GB with in-conversation truncation notice. Agents that produce very large outputs (logs, dumps, generated artifacts) now get an explicit truncation signal in the conversation rather than silently reading a partial file. Defense against accidental multi-GB tmp writes.
4. Subagent prompt-cache reuse is fixed for two common drift cases. Foreground-spawned subagent resume and SubagentStart-hook + preloaded-skills placement no longer shift the cache prefix. For a multi-agent workflow that was looking cache-cold only because of the prefix drift, the cache-hit rate should improve after v2.1.265 — material cost savings on Fable 5.1 / Mythos 5.1 cache reads at $0.25 per million tokens.
5. Plugin path safety is now consistent across macOS, Linux, and Windows-style separators. The backslash symlink bypass and the .something directory name false refusal are both closed. Plugin containment is enforced uniformly. Artifact publish through connectors is now constrained to the connector's actual exposed tool surface.
6. MCP HTTP+SSE transport fallback and deferred OAuth registration. MCP servers configured as http that only speak HTTP+SSE now connect via the SSE fallback. Remote MCP servers that need OAuth sign-in no longer register an OAuth client on incidental contact — only on actual authentication.
The v2.1.266 follow-up: the v2.1.265 CLAUDE_CODE_USE_GATEWAY regression is closed; the variable on its own is ignored again.
If you run Claude Code in any of the following configurations, v2.1.265 has material content for you:
user.email and user.groups are forwarded, redacted, or filtered. If your security policy prohibits identity fields in telemetry, work with the gateway admin to redact at the relay.--plugin-dir pointing at plugins/ (a folder of plugins) is now the workflow. Add/remove subdirectories while Claude Code is running without restart. Audit your existing --plugin-dir invocations to see whether they pointed at one plugin or a folder; the new behavior is a folder of plugins./cost or in API telemetry, expect an improvement on subagent-heavy runs.-p non-interactive sessions across multiple turns. cd directory && do_thing now persists across turns in -p mode, Agent SDK, and cloud sessions. If your CI scripts relied on per-turn cwd reset, audit them for the new persistent cwd behavior.If you pinned v2.1.265 in CI and saw widespread "Not signed in to the Cloud gateway" failures, upgrade to v2.1.266 — the regression is closed, no configuration change needed.
Primary sources verified at 2026-09-09 12:08 UTC:
CLAUDE_CODE_USE_GATEWAY regression fixupdated 2026-09-08T23:55:08ZNo firsthand test was run. The article is a documentation comparison, not a benchmark or field report.
Cost. No API pricing changes in v2.1.265 or v2.1.266. The cache-hit improvements on subagent workflows are a cost reduction on Fable 5.1 / Mythos 5.1 cache reads ($0.25 per million tokens, 0.025x) vs an artificial cache-cold miss — the same operation at the same price, but the cache-hit path now works where it previously didn't. For a developer running high-volume agent teammates with prompt prefixes that drift across turns, expect a measurable reduction in input-token spend on the next cache-warming cycle. The improvement is bounded by how much of your prior input-token spend was cache-miss that should have been cache-hit because of the prefix drift.
Risk. Two risks to flag:
user.email and user.groups as restricted identifiers, this change moves them onto the wire from Desktop and Cowork specifically. Terminal sessions were already sending these fields; the new addition is Desktop + Cowork parity. Verify your gateway config before bumping.CLAUDE_CODE_USE_GATEWAY regression broke any setup that combined the variable with an API key, apiKeyHelper, or custom auth headers. v2.1.266 closes the regression, but if you deployed v2.1.265 to a fleet that hit the regression, the recovery is openclaw update (or the equivalent CLI bump) to v2.1.266. No configuration change required.Limitations.
/skill-doctor reports (per-skill context cost) was not re-fetched and may use either declared skill size or runtime usage measurement; builders should consult the docs page for the precise computation.OTEL_EXPORTER_OTLP_ENDPOINT; sessions without that managed-setting entry still use the relay.http transport that speak HTTP+SSE will now connect via SSE, but the explicit transport declaration is still the source of truth for new deployments.claude-api skill's error-code reference fix updates the skill's internal table; the API's actual status codes are documented on the platform.claude.com error-codes page, which is the authoritative reference for API consumers./cost or API telemetry before and after. There is no new logging that calls out "this turn was a cache hit because of the v2.1.265 fix."Claude Code v2.1.265 is a substantial operational release, not a feature drop. The headline items are the privacy-relevant telemetry parity on Claude apps gateway, the plugin-folder load path, the subagent prompt-cache reuse fixes, and three plugin path safety fixes. v2.1.266 is a targeted regression fix for a v2.1.265 bug in the CLAUDE_CODE_USE_GATEWAY env var.
For a developer running Claude Code in CI or unattended agents, the prompt-cache reuse fixes are the quiet cost win. For a developer using Claude Desktop or Cowork through a Claude apps gateway, the telemetry change is the privacy conversation to have with the security team. For a team shipping a plugin catalog, --plugin-dir as a folder of plugins is the workflow improvement. For a developer running Claude Code in a Windows enterprise sandbox, the file-tool fix is the operational unlock.
Pin v2.1.266 in production. Read the v2.1.265 release notes end-to-end before bumping a fleet. Audit your gateway config for user.email and user.groups if you route Desktop or Cowork through it.
Today
CLAUDE_CODE_USE_GATEWAY, ANTHROPIC_BASE_URL, and ANTHROPIC_AUTH_TOKEN env vars on every host that runs Claude Code. The v2.1.265 regression affected any setup that combined CLAUDE_CODE_USE_GATEWAY with an API key, apiKeyHelper, or custom auth headers; v2.1.266 closes the regression but the underlying combinations were never officially supported.user.email and user.groups are redacted at the relay boundary or forwarded as-is. Coordinate with the gateway admin before bumping to v2.1.265 in any fleet that includes Claude Desktop or Cowork clients.This week
--plugin-dir to point at the folder (e.g., --plugin-dir plugins/) and remove the per-plugin invocation. Verify add/remove of child folders is picked up live./cost or in API telemetry before and after the bump. Expect an improvement on workflows that were cache-cold only because of prefix drift.Skip if not in scope
--plugin-dir folder change and the plugin path safety fixes don't affect you.Originally published: 2026-09-09 12:08 UTC Last verified: 2026-09-09 12:08 UTC No corrections at this time.