Claude Code v2.1.267 was tagged 2026-09-09 19:58 UTC, ~24 hours after the v2.1.265/v2.1.266 release that Tuesday's daily Charter Pillar covered in full. v2.1.266 was a single-line v2.1.265 regression fix (the undocumented CLAUDE_CODE_USE_GATEWAY env var on its own was forcing Cloud-gateway sign-in). v2.1.267 is the substantive follow-up: two new settings plus ~50 fix items, the majority of which close prompt-cache reuse breaks on resumed sessions, mid-session MCP reconnects, and /model switches.
Two new capabilities headline the release, both shipped verbatim from the v2.1.267 release notes:
maxEffortLevel setting — top-level or per model under modelSettings. "Caps the effort level on every provider, including Bedrock, Vertex and Foundry; users can still pick a lower level." The cap is a ceiling, not a floor. This is the first multi-provider effort cap in Claude Code; previously effort was per-request via the effort beta header or per-model pinned defaults (Opus 4.7, Opus 4.8, Fable 5).--system-prompt-snapshot off — "Render the system prompt fresh on every request instead of reusing the conversation's recorded prompt (for iterating on prompt text)." The on-default behavior is to record the system prompt once and reuse it for prompt-cache reuse. The off switch trades cache hits for prompt-iteration speed during development.The fix list is dominated by prompt-cache stability. From the v2.1.267 release notes, verbatim:
Two security-relevant fixes shipped in the same release:
allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins to admit nothing, not everything, when unreadable" (managed-settings hardening — fail-closed instead of fail-open)Plus an operational fix worth flagging: "Fixed expired AWS or Google Cloud credentials under a host app such as Claude Desktop retrying ten times with a generic 'request failed' before the re-authenticate error appeared."
Cost: prompt-cache reuse is the largest line-item lever for any team running Claude Code at scale. A session that re-renders tool descriptions or re-sends every tool definition on every resume silently bills against the uncached input rate instead of the cached rate. The cumulative effect across resumed long-running sessions is meaningful: one user-reported scenario where /model was forcing a full re-render of the tool list each call translated into visible cache-miss deltas. v2.1.267 closes at least ten distinct resume/reconnect paths that triggered these misses.
Effort control across providers: maxEffortLevel is the first setting that lets an organization enforce an effort ceiling on Bedrock, Vertex, and Foundry simultaneously. Teams running Claude Code on multiple cloud providers have had no uniform knob to prevent runaway effort calls; this is the first one.
Security posture: the marketplace-entry backslash bypass fix closes a path-traversal variant on macOS and Linux — a small but real risk for orgs that consume third-party plugins via marketplace entries. The managed-settings fail-closed fix is more important: a managed setting file that fails to parse now denies all hooks/channels rather than permitting all of them, which is the safer default and matches enterprise managed-settings expectations.
Prompt iteration cost: --system-prompt-snapshot off is a developer-experience win for anyone iterating on long system prompts. The trade-off (no prompt-cache reuse) is explicit and the flag is off-default.
All claims sourced verbatim from anthropics/claude-code/releases/tag/v2.1.267 (fetched 2026-09-10 14:08 UTC). Cross-referenced against the GitHub atom feed (anthropics/claude-code/releases.atom, updated 2026-09-09T19:58:08Z) for release timestamp. The full ~50-item list is on the release page; this article documents the items most consequential for builder code paths.
No firsthand test run was performed. Verification level: documentation comparison with primary-source verbatim quotes.
maxEffortLevel does not change per-token rates; the cap is a usage-control lever, not a pricing lever. --system-prompt-snapshot off will increase uncached input tokens and therefore bill against the uncached rate; teams iterating on system prompts should expect higher short-term spend and revert to default after iteration.allowedHttpHookUrls: "*") should audit their managed-settings file for readability — the v2.1.267 change to fail-closed on unreadable settings is a behavior change that may surface in environments where settings files have been intentionally permissive or are generated by tooling.v2.1.267 is a quiet but material release. The two new settings (maxEffortLevel, --system-prompt-snapshot off) are well-scoped capability additions. The ~10 prompt-cache reuse fixes are the largest cost-control improvement Claude Code has shipped in a single release since v2.1.251. The marketplace backslash bypass fix and the managed-settings fail-closed fix are the security headline. None of these are breaking changes for existing workflows; all are improvements that should reduce variance in cache-hit rates and managed-settings audit posture.
allowedHttpHookUrls / allowedChannelPlugins entries that v2.1.267's fail-closed behavior may now reject.--system-prompt-snapshot off during the iteration window and revert to default before benchmarking or production runs.Originally published: 2026-09-10 14:08 UTC Last verified: 2026-09-10 14:08 UTC No corrections at this time.