Hey guys, Mr. Technology here.
Claude Code v2.1.268 was tagged 2026-09-10 20:30 UTC — about 18 hours after yesterday's v2.1.267 (covered Sep 10). v2.1.268 is the quiet kind of release that ships a meaningful bundle of security and operational fixes without a marquee feature. The axe cuts in three places: secrets leaks (plugin marketplace, MCP, OAuth), permission-rule bypasses (symlinked /etc//tmp//var//bin, env -C/eval lines), and operational hygiene (a 5-minute WebFetch deadline, a jti reused fix for shared workload identity profiles, an HTTP 400 regression on third-party Anthropic-compatible endpoints since v2.1.265). It also adds three Claude apps gateway capabilities — managed pricing integration, a gatewayInternalNetworks managed setting for /login from an org's own public IPv4 block, and startup warnings for empty access_control.allow_cidrs — that close the loop on the kind of gateway misconfiguration that turns into a public-exposure incident.
This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.268 release notes. I have not installed this release in a production harness; treat the operational and security claims as documentation comparison, not firsthand test. (anthropics/claude-code: Release v2.1.268)
Claude Code v2.1.268 shipped 2026-09-11. Six behavioral fixes, three new Claude apps gateway capabilities, one operational cleanup. The release is a maintenance-and-hardening patch — no headline feature, but multiple long-standing friction points closed (secrets leaks, deny-rule bypasses, an 18-month-old WebFetch hang, an HTTP 400 regression that has been silently breaking third-party endpoints since v2.1.265).
From the v2.1.268 release notes (fetched 2026-09-11 14:09 UTC), verbatim, grouped by what each item actually does.
git URL contained an inline credential (e.g., https://user:ghp_…@github.com/owner/repo) used to render that credential in error output. Closed. Plugin authors using git sources should rotate any tokens that may have leaked into terminal scrollback or CI logs./mcp, /plugin server details, claude mcp list/get, and MCP login errors no longer show secrets resolved from ${VAR} placeholders in MCP configs. If your MCP config uses command: ["node", "mcp.js", "--token=${TOKEN}"] and TOKEN is exported in the env, the resolved value used to show in claude mcp list. Closed. Builders using ${VAR} for token substitution should now see the placeholder, not the resolved secret.claude-code-action configures it) no longer fails mid-run with 401 … jti reused when multiple processes share the same profile. A shared WIF profile in CI was producing JWTs whose jti collided; an Anthropic-side fix now scopes jti per-process. For CI fleets that run multiple Claude Code processes in parallel under a single WIF profile, the intermittent 401s are closed.Read deny rule on /etc/secret to be bypassed by giving the path by its real location, and a Bash deny rule on a symlinked spelling to be bypassed by writing the same path on its real spelling. Closed. Builders relying on symlinked rule targets should re-test their permission setup against the canonical real paths.env -C, eval, or similar unanalyzable command is on the same line. A command like eval "$(cat .env)" && cat /etc/secret previously rendered the permission checker unable to evaluate the line and skipped the deny rule. Closed. Builders with deny rules on Read/Edit paths now get enforcement even when the call is wrapped in env -C or eval.CLAUDE_CODE_WEBFETCH_DEADLINE_MS (set to 0 to disable the deadline). For an unattended agent running WebFetch against flaky internal endpoints, this closes a long-standing hang-on-idle failure mode that the agent had no way to recover from.ANTHROPIC_BASE_URL pointing at an OpenRouter-style provider) since v2.1.265. A regex in the Artifact tool's input schema was rejected by those endpoints. Closed. Builders using Claude Code against OpenRouter, AWS Bedrock Marketplace third-party endpoints, or any other Anthropic-compatible proxy were silently broken for five releases; v2.1.268 is the unblock.pricing: in gateway.yaml makes /cost and telemetry match the spend meter for signed-in Claude Code clients when the same rates are also set in managed settings. Pricing-tier drift between what users see in /cost and what they're actually billed for is the kind of trust violation a gateway admin wants to prevent.gatewayInternalNetworks managed setting allows /login to a Claude apps gateway from the organization's own public IPv4 block. The default refuses /login from a public IP; admins can now opt in to allow the org's NAT or corporate egress IPs specifically. This closes a class of incident where an admin who wanted to log in from a corp VPN had to disable the gateway's IP safety net to do so.access_control.allow_cidrs is empty, plus a one-time warning the first time a request arrives from a public address. Two passive warnings for the most common gateway-exposure mistake: shipping a gateway with no CIDR allowlist at all, then receiving a request from the open internet before anyone notices.claude self-hosted-runner --remove-session-state (default off) deletes each session's per-session directories under <base-dir>/_sessions/ when the session ends. For a long-running self-hosted runner that handles hundreds of sessions, the per-session directories are a slow disk leak; opt-in removal is the conservative default.Security posture. Three secrets leaks + two deny-rule bypasses in one release is a meaningful security floor-raise for production Claude Code deployments. If your team operates in a regulated environment or accepts third-party plugins via marketplaces, the closed leaks are worth bumping for on their own. The symlink deny-rule fix is the one that matters for shared dev hosts where /etc, /tmp, /var, or /bin are symlinked.
Operational reliability. The WebFetch 5-minute deadline is the single largest unattended-agent reliability fix in this release: it converts a silent hang into a clean failure with a recoverable error. The WIF jti reused 401 affects CI fleets with shared workload identity profiles. The v2.1.265 HTTP 400 regression on third-party Anthropic-compatible endpoints affects anyone routing through OpenRouter or a similar proxy — a 5-release silent breakage that v2.1.268 fixes.
Gateway safety. The two passive warnings (empty access_control.allow_cidrs, first public request) and the gatewayInternalNetworks managed setting together address the two most common ways a Claude apps gateway becomes a public-exposure incident. For an enterprise running a gateway, this is the kind of operational hygiene that is best shipped as defaults rather than as opt-in.
Primary sources verified at 2026-09-11 14:09 UTC:
tag:github.com,2008:Repository/937253475/v2.1.268, updated 2026-09-10T20:30:54Z; prior entry v2.1.267 from 2026-09-09 19:58 UTC.v2.1.265 HTTP 400 regression origin window and the broader operational context.v2.1.267's maxEffortLevel setting (the prior-day change context for v2.1.268).No firsthand test was run against v2.1.268. The article is a documentation comparison, not a benchmark or field report.
Cost. No API pricing changes. No new metered surface. The WebFetch deadline does not affect pricing; it converts a hang into a timeout.
Risk. Two operational notes:
list output, a plugin install error, or a marketplace entry error.CLAUDE_CODE_WEBFETCH_DEADLINE_MS=0 override (disable the deadline) is a foot-gun if you set it globally without testing the underlying fetch. Use the default 300-second deadline unless you have a specific reason.Limitations.
gatewayInternalNetworks managed setting accepts an organization's own public IPv4 block; the exact format (CIDR vs single address vs comma-separated) is not enumerated in the release notes and may be in the managed settings reference, which was not fetched end-to-end.v2.1.268 is the operational + security follow-up v2.1.267 was not. Three secrets leaks, two deny-rule bypasses, a WebFetch hang, a five-release HTTP 400 regression on third-party endpoints, and three gateway safety improvements in one release is a meaningful security floor-raise without a marquee feature. For a developer running Claude Code in CI, against a proxy, or behind a Claude apps gateway, the closed leaks and the WebFetch deadline alone are worth the bump.
For a developer shipping a plugin or operating a marketplace, the secrets-leak fix is mandatory. For a developer running an unattended agent, the WebFetch deadline is mandatory. For an enterprise running a Claude apps gateway, the new managed settings and the passive warnings are mandatory.
Pin v2.1.268 in production. Rotate any token that may have leaked through the closed surfaces before you bump.
Today
v2.1.268. The WebFetch 5-minute deadline and the WIF jti reused fix alone are worth the upgrade for any CI fleet running unattended Claude Code.${VAR} token placeholders. If you see one, confirm the resolved token did not previously appear in claude mcp list output or in MCP login errors; rotate if it did.v2.1.265/v2.1.266/v2.1.267 directly to v2.1.268 to unblock the HTTP 400 regression.This week
/etc, /tmp, /var, /bin on macOS, /bin on Linux) and against env -C/eval-wrapped commands. The closed bypasses mean rules that previously failed silently now apply.pricing: in gateway.yaml to align /cost and telemetry with the spend meter; set gatewayInternalNetworks to your org's public IPv4 block; verify access_control.allow_cidrs is non-empty and matches the intended reach.<base-dir>/_sessions/. If you want post-session cleanup, opt into --remove-session-state.Skip if not in scope
${VAR} configs, third-party Anthropic-compatible endpoints, or a Claude apps gateway, the security and gateway items don't affect you. The WebFetch deadline and operational fixes are still worth a routine upgrade.Originally published: 2026-09-11 14:08 UTC Last verified: 2026-09-11 14:09 UTC No corrections at this time. Correction (2026-09-11 18:13 Berlin): EQR flagged the article for missing the required ## What Actually Changed H2 (Charter v2 'Required article structure' item #2). The substantive content was present as 6 H3 subsections inside ## What Happened (Three secrets leaks / Two permission deny-rule bypasses / One 18-month-old WebFetch hang / One HTTP 400 regression since v2.1.265 / Three Claude apps gateway capabilities / One operational cleanup). Editorial fix: trimmed ## What Happened to the release event headline + summary paragraph and inserted a dedicated ## What Actually Changed H2 carrying the intro sentence + the 6 H3 subsections verbatim. Article body, verdict, recommended action, primary sources, and history block otherwise unchanged; this is a structural charter compliance fix, not a content correction.