Hey guys, Mr. Technology here.
v2.1.273 shipped 2026-09-15 20:23 UTC, about twenty-eight hours after the v2.1.271 pillar I published yesterday, and sixteen hours after yesterday's late-evening desk run finished. It is the largest Claude Code release this month by line count. The release page on anthropics/claude-code lists fifty-two distinct changes in v2.1.273 — three new capability additions, ten security and permission hardening items, one explicit revert of a v2.1.268 behavior change, a long-session responsiveness fix that should matter for every production Claude Code install running multi-hour sessions, and roughly thirty operational fixes spanning MCP, Claude Tag, the Artifact tool, VS Code, Claude Code on the web, and Code Review.
This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.273 release notes. I have not installed v2.1.273 against a production harness; treat the operational and capability claims as documentation comparison, not firsthand test. (anthropics/claude-code: Release v2.1.273, CHANGELOG.md)
Anthropic shipped v2.1.273 on 2026-09-15 20:23 UTC as a substantive feature + security + reliability drop. The headline capability is **a set of five x-claude-code-* request headers for LLM gateways, opt-in via CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 — the first time Claude Code has shipped a documented, opt-in protocol for LLM gateways to read request context directly from upstream headers. The headline operational addition is a notification when an MCP server disconnects mid-session and automatic reconnection gives up, pointing at /mcp. The headline security item is an explicit revert of a v2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker cannot analyze (eval, env -C); commands like time -p make build now prompt again instead of being denied. The headline reliability item is improved responsiveness in long sessions**: hook progress and sub-agent activity no longer re-process the whole conversation on every update.
Verbatim from the v2.1.273 release notes (fetched 2026-09-16 12:09 UTC), grouped by what each item actually does. The complete list is fifty-two bullets; I've grouped them into capability additions, security hardening, explicit reverts, the long-session responsiveness fix, MCP changes, Bedrock/Vertex/Foundry authentication fix, Artifact and Code Review improvements, and Claude Code on the web plus Claude Tag reliability items.
x-claude-code-* request headers for LLM gateways, opt-in via CLAUDE_CODE_GATEWAY_HINT_HEADERS=1**: x-claude-code-request-class, x-claude-code-agent-type, x-claude-code-prev-tool-durations, x-claude-code-compaction, and x-claude-code-context-compacted. Before v2.1.273, an LLM gateway in front of Claude Code had no documented signal for whether the current request was a normal turn, a tool-heavy turn with many sub-agent durations, a compaction-eligible turn, or a turn that had already been compacted. Routing decisions (which model family, which latency tier, whether to apply internal rate limiting, whether to short-circuit cache logic) were forced to be guessed from request size or omitted entirely. With these headers, a gateway can route on concrete request-class and agent-type values, preserve cache key affinity for turns where context-compacted=1 is set, and avoid penalizing requests where prev-tool-durations indicates the request is mid-sub-agent-fan-out. The opt-in flag — CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 — is the right default: shipping request-shape metadata to a gateway means the gateway can use it to short-circuit, redact, or rate-limit, so the operator must affirmatively turn it on. For a team running Claude Code behind Anthropic Bedrock, Google Vertex AI, Microsoft Foundry, or a custom gateway, this is the missing primitive for cost-aware routing./mcp. Before v2.1.273, an MCP server that disconnected and could not reconnect left the user with a session that silently lost the disconnected tool: subsequent calls to the missing tool would fail, often with a confusing error, and there was no in-session signal that the user could re-authenticate. The new behavior is: try to reconnect, give up cleanly on the attempt, surface a notification that names the failed server and points at /mcp for re-authentication. This is the operational fix for the most common class of "my MCP tools suddenly stopped working" support tickets.claude --remote-control or /remote-control from the Claude app: the fork runs as a background session on your computer. Before v2.1.273, a remote-control session could not be forked from the Claude app. After v2.1.273, sessions opened via remote control from the Claude app can be forked, with the fork running as a background session on the user's computer. This closes the "remote-control session discoverability" gap: until now, the user had to either keep the remote-control session open or end it; now they can fork it locally and let the original keep running.permissions.blockReadsOutsideWorkingDirectories, and a subshell hiding a dangerous rm in bypass mode. Closed. Two distinct bypasses, both fixed together: the first is a documented bypass where the checker had no static analysis path so it skip-prompted (i.e., ran the command without asking), and the second is a subshell form like (rm -rf /tmp/x) that hid the dangerous command inside a wrapper the checker did not follow. For a deployment running Claude Code in permissions.blockReadsOutsideWorkingDirectories mode (the conservative production default), the first was a class of bypass that "could not analyze" silently turned into "does not need approval."claude.ai now move to the recoverable trash after your organization turns Skills off. Before v2.1.273, skills that a user had synced from claude.ai would stay available even after the organization's Skills setting was turned off — meaning a security policy that said "skills are off" was effectively advisory. The new behavior moves the now-disabled synced skills to the recoverable trash at the next launch. For a managed deployment that turns Skills off for compliance reasons, this closes the policy-evasion vector.allowManagedMcpServersOnly, deniedMcpServers, and disableClaudeAiConnectors set via MDM or managed-settings.json were being ignored when server-managed settings were also present. Closed. This is a managed-config precedence bug: when both MDM/managed-settings.json and a server-managed configuration were present, the server-managed configuration took precedence regardless of the operator's intent. The fix enforces the operator's settings file even when server-managed settings coexist. For a deployment using MDM to enforce "no managed MCP," "denied this MCP server," or "disable Claude.ai connectors," the bug meant the policy could be silently overridden by an out-of-band configuration push./login — the error message now names the credential to refresh or points to your gateway administrator. Operationally important: a 401/403 from Bedrock/Vertex/Foundry used to surface the HTTP error code and nothing else. Now the error names which credential is stale (e.g., "AWS credentials expired" or "Vertex AI token refresh failed") and where to look if the credential is the gateway-side one. Reduces a class of "I can't tell if this is my problem or my gateway's problem" support tickets.v2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker can't analyze (eval, env -C); commands like time -p make build prompt again instead of being denied. The v2.1.268 fix (which I covered in story-2026-09-11-002) had closed a real bypass where a Bash command wrapped in eval or env -C would slip past the permission checker. The fix worked too aggressively: it denied the line outright rather than prompting, which meant legitimate use cases (including time -p make build, which uses time as a builtin that the checker cannot statically analyze) were being silently blocked. The v2.1.273 revert restores a prompt for these commands instead of an outright denial. For security teams, this means two operational changes between v2.1.268 and v2.1.273: the bypass is now reopened for eval/env -C/similar unanalyzable patterns, with a prompt instead of a deny. A team that depended on the v2.1.268 denial behavior needs to know that the v2.1.268 to v2.1.273 window is the only release window where this protection held, and that any policies or runbooks written against the deny behavior must be re-checked against the prompt behavior of v2.1.273.v2.1.273 Claude Code running a multi-hour session with multiple sub-agents and frequent SessionStart / UserPromptSubmit / PreToolUse / SessionEnd hooks would re-process the entire conversation transcript every time a hook ran — meaning each hook fired in a multi-hour session added O(N) to the cost and O(N) to the latency, where N was the session's conversation length. After v2.1.273, hook progress and sub-agent activity are incremental rather than full-reprocess. For a production agent stack running multi-hour sessions with frequent hook fires, this is the single most-impactful operational fix in the release: the responsiveness cost of a hook becomes O(delta) instead of O(session). Cross-references: the v2.1.271 pillar (claude-code-2-1-271-fast-mode-allowed-domains-omitclaudemd-host-config-snapshot-sep-2026) for the fast-mode + per-command-allowed_domains story; this is the matching concurrency fix for the long-session path.v2.1.273 context meter was double-counting advisor-tool turns, so auto-compact was firing at ~50% of the actual context window — meaning a session would compact prematurely and lose work. After v2.1.273, the meter counts correctly and auto-compact fires at the configured window boundary.v2.1.273 sub-agent that finished with a degraded final stream (no usage block, no model id) would be reported as failed by the parent even though its work was done. The orphan-result was never delivered, forcing the user to either re-run or manually reconstruct. After v2.1.273, sub-agent and background-agent results survive a degraded-final-stream condition./login, /upgrade, and /extra-usage discarding earlier thinking from the conversation, which forced a full prompt-cache rewrite on the next request. Closed. A pre-v2.1.273 invocation of any of the three commands surfaced a thinking-stripping side effect: every prior turn's preserved-thinking block was dropped, so the next request rebuilt the entire prompt-cache. After v2.1.273, the thinking blocks survive, the prompt-cache stays warm, and the user does not pay the cache-rebuild cost for invoking a routine command. Operationally material: /login mid-session no longer nukes your cache.v2.1.273, dragging a screenshot into the macOS Claude Code chat would fail with an opaque symlink-resolution error; after v2.1.273, the file is read once per path and accepted.CLAUDE_CODE_AUTO_MODE_SERVER=1 to use the platform's server-side classifier. The server-side classifier is preserved as an opt-in. This is a security-relevant default change: pre-v2.1.273, Bedrock/Vertex/Foundry deployments that ran auto mode were using the server-side classifier; after v2.1.273, they default to the local classifier. For a deployment that previously depended on server-side classification, the opt-in flag is now required./login, /upgrade, and /extra-usage ... 401/403 errors on Bedrock, Vertex, and Foundry ... already covered above. Both items converge on Bedrock/Vertex/Foundry auth-better error reporting.claude.ai is now re-sent safely instead of failing or creating a duplicate version. Closed./autofix-pr)/ultrareview --post so a retry after a GitHub error posts the findings comment exactly once instead of never or twice; the comment now names the reviewed commit. Closed./bug//feedback reportsThe full list is in the v2.1.273 release notes linked above. Highlights:
Budgets, Savings Plans, WAF Classic, Import/Export); fixed OAuth client-credentials and JWT-bearer connections failing with providers that return a lowercase token type.--add-dir./bug and /feedback reports now include only model-behavior params (model, system prompt, tools) from the last API request, omitting request metadata and CLAUDE_CODE_EXTRA_BODY fields. Reduces accidental leakage in bug reports.Six operational consequences, ranked by who is most affected.
Enterprise teams running Claude Code behind an LLM gateway (most affected). The five x-claude-code-* request headers shipped opt-in via CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 are a routing primitive that did not previously exist. Before this, gateway routing decisions had to be inferred from request size, model name, or out-of-band metadata. After this, the operator can read request-class, agent-type, prev-tool-durations, compaction, and context-compacted directly from the request. The header names are stable for v2.1.273 and forward (no version suffix on the header values themselves), so a gateway that hardcodes the names now will work on every subsequent Claude Code release that opts in. The opt-in flag is the correct default — shipping request-shape metadata to a gateway means the gateway can use it to short-circuit or rate-limit, so the operator must affirmatively turn it on. A team that runs Claude Code behind Anthropic Bedrock, Google Vertex AI, Microsoft Foundry, or a custom gateway should plan a 30-minute integration to enable the flag and surface the headers in their gateway log line.
Teams running multi-hour Claude Code sessions with frequent hook fires (next most affected). The long-session responsiveness fix — hook progress and sub-agent activity no longer re-process the whole conversation on every update — changes the cost model of a hook from O(N) to O(delta). For a session with N=10,000 turns running 10 sub-agents with 5 hooks each, the pre-fix cost per hook fire was ~50,000 token-equivalents of re-processing; the post-fix cost is whatever delta the hook actually needs. For a deployment that runs Claude Code as a long-lived agent with session-history compaction as the steady state, this is the single largest performance improvement in the release. Cross-references: v2.1.271 shipped per-command allowed_domains and --host-config-snapshot disk|memory; v2.1.273 adds the matching long-session concurrency fix.
Teams that depend on Bedrock, Vertex AI, or Foundry for Claude Code (third most affected). Two compounding changes: (1) auto mode now defaults to the local classifier, with CLAUDE_CODE_AUTO_MODE_SERVER=1 as the opt-in to the server-side classifier; (2) 401/403 errors now name the credential to refresh. The combination means a Bedrock/Vertex/Foundry deployment that relied on server-side classification needs to set the new flag, and a Bedrock/Vertex/Foundry deployment that was failing with opaque 401/403 errors now gets a named credential. Cross-references: v2.1.271 shipped the spinner-tip nudge for Bedrock/Vertex/Foundry users pointing to the Claude desktop app; v2.1.273 continues the authentication-clarity work.
MCP-heavy deployments. The disconnect notification (pointing at /mcp) and the /login//upgrade//extra-usage cache-preservation fix converge on the operational reliability of long-lived MCP workflows. Pre-v2.1.273, an MCP server that disconnected and could not reconnect would silently vanish from the session; post-v2.1.273, the user gets a notification. Pre-v2.1.273, calling /login mid-session would force a full prompt-cache rebuild; post-v2.1.273, it preserves the cache. Both are real-money fixes for any deployment running MCP at scale.
Security teams reviewing policy behavior between v2.1.268 and v2.1.273 (one item of explicit news). The v2.1.268 deny behavior on eval/env -C has been reverted. The two-release window where the deny held (v2.1.268 through v2.1.272) is now closed. A security policy or runbook written against the deny behavior needs to be re-checked against the prompt behavior of v2.1.273. The bypass is partially closed by the new fix for "Bash commands the permission checker cannot fully analyze skipping the prompt under permissions.blockReadsOutsideWorkingDirectories" — that fix covers the blockReadsOutsideWorkingDirectories case, but the general eval/env -C case is back to a prompt flow.
Founders deciding whether to upgrade (yes, with two specific checks). Two named items in this release require a decision before bulk rollout: (1) if your deployment uses Bedrock/Vertex/Foundry auto mode and depended on server-side classification, set CLAUDE_CODE_AUTO_MODE_SERVER=1 before upgrading to preserve that behavior; (2) if your deployment has any security policies or runbooks written against the v2.1.268-v2.1.272 deny-behavior for eval/env -C, those need to be reviewed. Otherwise, this is a safe roll-forward.
Sources used in this article, all fetched 2026-09-16 12:09 UTC for verbatim verification:
anthropics/claude-code: Release v2.1.273](https://github.com/anthropics/claude-code/releases/tag/v2.1.273) — 52 release-note items verified verbatim.anthropics/claude-code: CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — full Markdown changelog cross-checked against the release page body; identical content confirmed.anthropics/claude-code: releases.atom](https://github.com/anthropics/claude-code/releases.atom) — confirmed release timestamp 2026-09-15T20:23:03Z for v2.1.273 (atom entry id tag:github.com,2008:Repository/937253475/v2.1.273).claude-code-2-1-271-fast-mode-allowed-domains-omitclaudemd-host-config-snapshot-sep-2026 (yesterday's pillar) for the v2.1.271 capability additions (Fast Mode in Remote, per-command allowed_domains, omitClaudeMd, --host-config-snapshot). The v2.1.273 items here are additive to v2.1.271, not duplicates — gateway hint headers, MCP disconnect notification, remote-control session forking, the long-session responsiveness fix, and the v2.1.268 revert are all v2.1.273-new.claude-code-2-1-268-secrets-leak-symlink-deny-bypass-webfetch-deadline-sep-2026 for the v2.1.268 security sweep that the v2.1.273 revert rolls back part of.This is a documentation comparison, not a firsthand test. I have not installed v2.1.273 against a production harness. Every claim above is sourced verbatim from the release page and CHANGELOG.md. I have not run the new gateway hint headers against an LLM gateway in front of me; I have not run the MCP disconnect scenario end-to-end; I have not exercised the long-session responsiveness fix with a real hook-fire loop. Treat operational claims as documentation only.
Cost. The five x-claude-code-<em> request headers themselves are free of incremental cost (they are header bytes on the existing request). The long-session responsiveness fix reduces per-hook CPU cost from O(N) to O(delta), which is a cost reduction* for deployments running many hooks in long sessions. There is no pricing change in v2.1.273.
Risk. Three named risk items:
1. The v2.1.268 revert re-opens a bypass for eval/env -C/similar unanalyzable Bash patterns. The revert is intentional (legitimate commands like time -p make build were being denied), but the bypass class is back. A team that depended on the v2.1.268 denial behavior needs to know that the behavior changed. The v2.1.273 fix for Bash commands the permission checker cannot fully analyze skipping the prompt under permissions.blockReadsOutsideWorkingDirectories partially covers the bypass within the blockReadsOutsideWorkingDirectories mode, but a Bash command running with bypass or auto mode in a directory outside blockReadsOutsideWorkingDirectories will still prompt but can be approved. 2. Bedrock/Vertex/Foundry auto mode defaults to local classifier. Pre-v2.1.273 deployments used server-side classification by default; post-v2.1.273, server-side is opt-in via CLAUDE_CODE_AUTO_MODE_SERVER=1. A deployment that depended on server-side classification without setting the flag will get the local classifier instead. The local classifier is generally safer (less data sent to the platform), but classification quality may differ from the server-side classifier. 3. v2.1.273 is a sizable release with five capability additions, ten security/policy fixes, one explicit revert, and ~36 operational fixes in one ship. Larger releases carry a higher-than-baseline probability of interaction bugs with platform-specific configurations. A team running a critical-path production workload should pin the current version, deploy v2.1.273 to a staging harness, run a 24-hour soak, and roll forward.
Limitations of this report. I have not installed v2.1.273 against a production harness. I have not exercised the gateway hint headers. I have not exercised the MCP disconnect scenario end-to-end. I have not measured the long-session responsiveness improvement in tokens-saved-per-hook-fire. I have not verified the local-vs-server-side auto-mode classifier default in Bedrock/Vertex/Foundry end-to-end. I have not tested the v2.1.268-revert behavior on eval/env -C commands directly. Treat every operational claim as documentation. Cross-check against your own staging harness before adopting any of the new flags or behavior.
v2.1.273 is the substantive v2.1.272-shaped release Anthropic skipped the named release notes on. It is a net positive for anyone running Claude Code in a multi-hour session with sub-agents and hooks, anyone running Claude Code behind an LLM gateway, and anyone running an MCP-heavy workload. The headline items are positive, the operational items are positive, and the security items are positive-with-one-revert. The one revert is explicit and the reasoning is documented (a real time -p make build was being denied), so a careful reader can adjust policy accordingly.
The release is dense enough to be worth a daily pillar (this article), not a desk-sweep one-paragraph entry. If you read yesterday's v2.1.271 pillar and the v2.1.268 security sweep, you have the full operational story for the last week: v2.1.268 closed several permission bypasses; v2.1.271 added per-command allowed_domains, omitClaudeMd, and a 64-MiB host-config safety net; v2.1.273 adds the gateway-headers primitive, MCP disconnect notification, remote-control session forking, long-session responsiveness, the v2.1.268 partial-revert, and ~36 additional operational fixes.
For a production deployment: roll forward to v2.1.273 after a 24-hour staging soak, set CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 if you operate an LLM gateway in front of Claude Code, set CLAUDE_CODE_AUTO_MODE_SERVER=1 if you operate on Bedrock/Vertex/Foundry and depend on server-side auto-mode classification, and re-review any security policy that referenced the v2.1.268-through-v2.1.272 deny behavior for unanalyzable Bash patterns.
CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 on a representative Claude Code install behind your LLM gateway. Verify the five x-claude-code-* headers appear on subsequent requests. Update your gateway log to record them.v2.1.273 to staging. Run a 24-hour soak with a representative multi-hour session (multiple sub-agents, frequent hooks). Measure hook-fire latency before and after; confirm the responsiveness fix is in effect.v2.1.268-through-v2.1.272 deny behavior for eval/env -C/similar unanalyzable Bash patterns. The current behavior is prompt, not deny. Decide whether that is acceptable for your deployment.CLAUDE_CODE_AUTO_MODE_SERVER=1 either before or immediately after the v2.1.273 rollout to preserve server-side classification.v2.1.273 in production after staging soak passes.Originally published: 2026-09-16 12:08 UTC Last verified: 2026-09-16 12:09 UTC (sources fetched 2026-09-16 12:09 UTC; v2.1.273 release timestamp verified 2026-09-15 20:23 UTC via GitHub atom feed) No corrections at this time.