Claude Code v2.1.271: Fast Mode in Remote, Per-Command allowed_domains for Sandboxed Bash, omitClaudeMd for Subagents, and a Host-Config-Snapshot Safety Net

Hey guys, Mr. Technology here.

Claude Code v2.1.271 shipped 2026-09-14 22:12 UTC, sixteen hours before this desk run, and was followed about two hours later by v2.1.272 ("bug fixes and reliability improvements" only). The release page on anthropics/claude-code lists ~50 changes for v2.1.271 itself — eight capability additions and roughly forty fixes spanning Bash permission checks, MCP OAuth and reconnect logic, organization-policy caching, remote control, self-hosted runners, the /fast toggle, the prompt cache, --resume, the artifact tool, VS Code integration, and Claude Code on the web.

This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.271 release notes. I have not installed v2.1.271 against a production harness; treat the operational and capability claims as documentation comparison, not firsthand test. (anthropics/claude-code: Release v2.1.271, v2.1.272)

What Happened

Anthropic shipped two Claude Code releases in the last twenty-four hours: v2.1.271 on 2026-09-14 22:12 UTC and v2.1.272 on 2026-09-15 00:42 UTC. The substantive release is v2.1.271. The headline capability is fast mode in Claude Code Remote sessions (cloud and self-hosted runners), which makes the host's fast-mode setting or an in-session /fast actually take effect in the runner. The headline security additions are per-command allowed_domains for sandboxed Bash, PowerShell, and Monitor in auto mode and managed-mcp.json now keeps exclusive MCP control when unparseable. The headline safety net is --host-config-snapshot disk|memory, which prevents self-hosted runners from silently losing all settings/skills/plugins/MCP servers when the host config directory exceeds 64 MiB.

The v2.1.272 release two hours later carries no public notes beyond "bug fixes and reliability improvements." Treated as NOVELTY_LOW; not surfaced as a separate change.

What Actually Changed

Verbatim from the v2.1.271 release notes (fetched 2026-09-15 14:08 UTC), grouped by what each item actually does.

Eight new capabilities

• Fast mode in Claude Code Remote sessions (cloud and self-hosted runners): the host's fast-mode setting, or /fast typed in the session, applies where the organization allows it. Pre-v2.1.271, Remote sessions honored the toggle inconsistently — the user-facing /fast flag toggled local behavior but did not propagate to the runner's model selection. After v2.1.271, the toggle works end-to-end on both cloud and self-hosted runners, gated by org policy.
• /config panel now supports the mouse in fullscreen mode: the wheel scrolls the settings list, a click on a setting's value changes it, and the row under the pointer is highlighted. Cosmetic UX, but it removes a long-standing terminal-mouse limitation that forced fullscreen users back to the keyboard for /config edits.
• claude self-hosted-runner --drain-marker-file <path>: when the marker file exists at a SIGTERM drain, the runner reports its exit to the server as a host drain (telemetry only). For a platform team orchestrating self-hosted runner pools, this is the missing signal to distinguish "the host is being intentionally drained" from "the runner crashed."
• Per-command allowed_domains to Bash, PowerShell, and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refused. This is the granular per-invocation network allowlist that mirrors the existing per-invocation file allowlist. Before this, sandboxed Bash could be configured to deny all network egress or permit all network egress, with no per-command middle ground.
• omitClaudeMd to agent frontmatter and --agents JSON: custom and plugin subagents can now run without user, project, and local CLAUDE.md files; managed policy files still load. For a plugin author shipping a subagent that needs a clean prompt surface (e.g., a tool-eval harness or a benchmark scorer), this avoids inheriting the host project's coding conventions.
• --accept-command <sha256> to claude plugin install and claude plugin update: accept exactly the command a previous --json run displayed, instead of -y. For a CI pipeline that installs plugins deterministically, this replaces the brittle -y flag (which accepts whatever the plugin currently proposes) with a reproducible SHA-256 pin.
• multiplier above 1, up to 10, in the modelPricing managed setting and the Claude apps gateway pricing block: for marked-up internal chargeback rates. For an enterprise that resells Claude Code at a markup to internal teams, this is the markup primitive that lets the cost-recovery dashboard show the marked-up rate without an external calculation layer.
• Spinner tips for Bedrock, Vertex AI, Foundry, and LLM gateway users now point to the Claude desktop app; the claude.ai desktop app tip suggests /desktop, which offers to download the app. UX nudge, not a capability.

One sandbox-and-MCP control tightening

• An enterprise managed-mcp.json that can't be read or parsed is no longer silently ignored. It now keeps exclusive MCP control (user, project, and plugin servers don't load) and warns at startup. Pre-v2.1.271, a broken or unreadable managed-mcp.json was treated as "no managed config" — falling back to user/project/plugin MCP servers, which is exactly what a managed-config deployment is supposed to prevent. Closed: failure now defaults to deny, not to fall-open.

Six Bash-permission check fixes

• Bash permission checks missing the file that fmt, column, and similar commands read when it follows an option the checker doesn't recognize. Closed.
• Bash permission checks skipping files a wildcard expands to when the wildcard sits in a command's pattern or option value (e.g., grep -v dir/* file). Closed.
• Bash permission checks so that shell variable declaration flags cannot misrepresent the command being run. Closed.
• Bash commands with two directory changes, a subshell, or a cd+git chain skipping the prompt under permissions.blockReadsOutsideWorkingDirectories in bypass and auto mode. Closed.
• A stale .git/config.lock breaking git checkout -b, git push -u, and git config for the rest of a session after a sandboxed command failed to start (Linux). Closed.
• Stale .gitignore race after a sandboxed command exited mid-write. Closed.

For a team running Claude Code in permissions.blockReadsOutsideWorkingDirectories mode (the conservative default for production code agents), each of these was a documented bypass where a single-character pattern difference would skip the read prompt. The v2.1.271 sweep closes six of them.

Three organization-policy and authentication fixes

• Cached organization policy was being reused after switching accounts, organizations, or API keys, and the policy not refreshing until the hourly check when the credential changed mid-session. Closed.
• Tool and command lists not updating when the organization policy finished loading after startup or changed mid-session. Closed.
• Org policy being fetched through, and rejected by, third-party local proxies set via ANTHROPIC_UNIX_SOCKET; they are again treated like other custom gateways, including for Remote Control. Closed.

For a managed-config deployment, the first two were silent-stale-policy bugs where the user's tool list was out of sync with the policy that should be authoritative.

Four MCP fixes

• Sustained high CPU usage and repeated tool-list requests when an MCP server sends list_changed notifications in a tight loop. Closed.
• MCP OAuth mishandling client registrations: denying consent forced a new one; one for another redirect URI was reused; a concurrent write could delete a valid one or keep a mismatched one. Closed.
• Tool search returning no match when Claude selects an MCP tool by its bare name instead of its full mcp__server__tool name. Closed.
• Ctrl+O cancelling pending MCP server reconnects, and /mcp sent from Remote Control failing while the transcript view is open. Closed.

The OAuth registration bug is the most security-relevant of the four — a concurrent write race that could leave a mismatched registration in place. Documented in the release notes as a fix; not separately CVE'd by Anthropic as of this writing.

Two --resume fixes

• --resume dropping the 1M context window ([1m]) when the resumed session's model family differs from the configured default model. Closed.
• /resume and /teleport keeping the previous conversation's file-read tracking, so Claude could edit files the resumed conversation had never read. Closed.

The second item is a real silent-privilege-escalation class: a resumed session inherits read-tracker state from the previous conversation, allowing edits to files the new conversation never explicitly read. Closed.

One self-hosted runner safety net

• Self-hosted runner sessions silently losing all host config (settings, skills, plugins, MCP servers) when the host config directory exceeds 64 MiB. Added --host-config-snapshot disk|memory. Closed.

This was the worst-impact bug in the release: a single runner with a too-large ~/.claude directory would silently boot into a session with no settings, no skills, no plugins, and no MCP — a complete agent-stack downgrade with no warning. The new flag (disk is the existing in-memory load, memory is the new disk-backed snapshot that survives a >64 MiB dir) is the recovery path.

Four fast-mode fixes

• /fast off answering "Fast mode unavailable" instead of turning fast mode off when the organization has fast mode disabled. Closed.
• Sessions started with CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK re-sending fast requests every turn after the API rejected fast mode; the rejection now stands and its reason is shown. Closed.
• Fast mode under CLAUDE_CODE_RETRY_WATCHDOG failing the turn on a usage-credits limit, or retrying an overload at fast speed, instead of falling back to standard speed. Closed.
• Sessions started in fast mode whose credentials changed mid-session continuing to send fast requests against an account that no longer permits them. Closed.

One skills cleanup

• Skills synced from claude.ai staying on disk indefinitely after signing out; copies not refreshed within cleanupPeriodDays now move to the recoverable trash at the next launch. Closed.

Plus the small-stuff sweep

• VS Code: Hooks dialog saves that landed as failed; Hooks dialog going blank under a plugin-only policy lock; Attach Open File setting; toggle-switch color theme fix; mapped-network-drive session history fix; console-window flash on Windows background commands; settings-change watcher polling fallback on saturated macOS file-event services.
• Claude Code on the web: Custom network access option in the Cloud environments editor; default-environment marker on the Cloud environments admin page; cloud session that took ~10 min to respond after its process exited while the session looked live (now restarts on first message).
• Dynamic workflows: pause when you hit your usage limit and continue automatically when it resets, instead of dropping the affected agents.
• Auto mode: a skill's or slash command's inline ! shell commands now follow default-mode permission rules instead of the classifier; a command no rule decides runs as a reviewed tool call. Subagents report back through a dedicated hand-back call that the safety classifier reviews, instead of the last message being reviewed after the fact.
• Monitor watches: always have a deadline (at most 30 minutes; 10 in single-prompt -p runs) and notify Claude to re-arm, replacing the no-timeout persistent option.
• Default dynamic workflow size dropped to small on Pro plans; medium size guideline lowered from 15 to 10 agents.

Why Developers and Founders Should Care

Four buckets of impact:

1. If you run Claude Code in a sandboxed environment that does network calls from Bash — the per-command allowed_domains change is the granular primitive you have been asking for. Pre-v2.1.271, the only options were "allow all network from Bash" or "deny all network from Bash"; per-command allowlists did not exist. Now you can write a permission rule that says "this curl command gets api.yourcompany.com and nothing else; that npm publish gets registry.npmjs.org and nothing else." For a team that scripts agents to hit internal APIs from Bash, this is the granularity needed to make sandboxing usable. 2. If you operate self-hosted runners at scale — --host-config-snapshot disk|memory is the safety net for the silent-config-loss bug, and --drain-marker-file <path> is the missing telemetry signal for intentional host drains. Both are operational primitives that close real failure modes. 3. If you manage Claude Code via a managed-mcp.json enterprise policy — the parse-failure behavior change is a security default flip. A broken managed-mcp.json used to silently fall back to user/project/plugin MCP servers; now it fails closed (exclusive managed MCP control, no fall-through) and warns at startup. Verify your managed-mcp.json parses cleanly on rollout. 4. If you build or install plugins from CI — --accept-command <sha256> is the reproducible-pinning primitive. Pin the SHA-256 of the command a previous --json install displayed, and CI can install the same plugin deterministically across environments.

Two secondary buckets worth noting:

• Resumed session privilege escalation closed: a resumed session no longer inherits the previous conversation's file-read tracker, which prevented edits to files the new conversation had never read. Anyone using --resume across conversations with different trust scopes should re-test.
• Dynamic workflows now pause on usage limits instead of dropping agents: a Workflow run that hits the rate limit mid-fan-out no longer cancels the affected agents; it pauses and resumes automatically when the limit resets.

Evidence and Verification

All capability and security claims above are taken verbatim from the v2.1.271 release page on GitHub. The page itself was fetched 2026-09-15 14:08 UTC. No firsthand install or runtime test was run for this article; treat all claims as documentation comparison. The release tag is v2.1.271, dated 2026-09-14 22:12:54Z, authored by ashwin-ant, and is the second-newest entry in the anthropics/claude-code atom feed as of this writing.

The v2.1.272 entry is two entries above v2.1.271 in the atom feed, dated 2026-09-15 00:42:25Z, with the single public note "Bug fixes and reliability improvements" and no linked changelog. Confirmed: v2.1.272 is treated as NOVELTY_LOW and not surfaced as a separate change.

Cost, Risk, and Limitations

• Cost: no published price change. The modelPricing multiplier setting is a chargeback primitive, not a new pricing tier; it does not affect what Anthropic charges. Fast mode remains gated by org policy and may bill differently per plan — consult your org's fast-mode settings page if you enable it.
• Risk:
• The managed-mcp.json parse-failure behavior change is a fail-closed security default. Teams that depended on the silent fall-through (e.g., to keep development working while ops debugs a malformed policy file) will see MCP servers stop loading until the file parses. Verify your managed-mcp.json is valid JSON and readable by the Claude Code process before rollout.
• Resumed-session file-read-tracker reset means any automation that depended on the previous behavior (e.g., resuming a session to edit a file the prior session read but the new one has not) will need an explicit Read call first. This is the correct behavior, but it is a workflow break for some teams.
• --host-config-snapshot memory adds a disk-backed snapshot of the host config. For runners with very large ~/.claude directories (the bug condition is >64 MiB), this can increase startup I/O by tens of milliseconds and add a small disk footprint. Negligible in practice; documented for completeness.
• Limitations: I have not run this release against a production harness. Every operational claim (e.g., "fast mode now works in Remote," "managed-mcp.json parse failures now fail closed") is documentation-surfacing, not firsthand test. Run your own smoke test before promoting v2.1.271 to production. The Bash permission-check fix sweep closes six specific documented bypasses; there may be additional bypasses not in this release — the next security sweep may close more.

Mr. Technology Verdict

v2.1.271 is the kind of release that justifies a fast upgrade for most teams and a slow upgrade for one specific class of users. Most teams get a real capability gain (fast mode in Remote, per-command allowed_domains, --accept-command <sha256>, --host-config-snapshot disk|memory) plus a real security tightening (managed-mcp.json parse-failure fail-closed, --resume file-read-tracker reset, six Bash permission-check bypasses closed). The one specific class that should slow-roll: teams with a managed-mcp.json that may not parse cleanly, who need to verify the file before promoting to v2.1.271 or they will see their managed-only MCP servers stop loading.

v2.1.272 two hours later is a stability patch with no public notes — install it on the same cadence as your normal reliability-update policy.

Recommended Action

Today:

• Read the v2.1.271 release page end to end. The eight capability additions are the primary value; the ~40 fixes are the security/perf bonus. (Release v2.1.271)
• If you operate a managed-mcp.json deployment, validate that the file parses cleanly (python3 -m json.tool < managed-mcp.json) and is readable by the Claude Code process, before promoting to v2.1.271.
• If you script agents that hit internal APIs from Bash, write a per-command allowed_domains permission rule and verify it is honored.

This week:

• If you operate self-hosted runners, add --host-config-snapshot disk|memory to your runner invocation and verify host configs >64 MiB now load correctly.
• If you install plugins from CI, switch from -y to --accept-command <sha256> and pin a known-good command hash.
• If you operate a runner pool, add --drain-marker-file <path> and verify the drain telemetry signal reaches your dashboard.

Skip if not in scope:

• If you do not use Claude Code in a managed or sandboxed deployment, the per-command allowed_domains and managed-mcp.json changes do not apply to you. The capability additions (fast mode in Remote, --accept-command, --host-config-snapshot, omitClaudeMd, multiplier) are still useful, but lower priority.

Sources

• anthropics/claude-code: Release v2.1.271 (2026-09-14 22:12 UTC) — primary; all capability and fix claims above are taken verbatim from this page.
• anthropics/claude-code: Release v2.1.272 (2026-09-15 00:42 UTC) — primary; treated as NOVELTY_LOW (bug fixes only, no public notes).
• anthropics/claude-code: atom feed — release-order reference.

Last verified: 2026-09-15 14:08 UTC. No corrections.