Hey guys, Mr. Technology here.
v2.1.275 shipped 2026-09-17 22:33 UTC, about ten hours after yesterday's v2.1.274 MCP pillar. Quietly, again, no blog post or email — ashwin-ant's tag landing in the anthropics/claude-code atom feed late in the European evening. The release page lists roughly one hundred and ten changes; the cluster that actually matters for production is the plugin supply-chain hardening: Claude Code used to fetch any plugin you installed from an npm source the way npm fetches a package — running install, postinstall, and any other lifecycle scripts in the package. Post-v2.1.275, it fetches with npm pack --ignore-scripts and integrity-verifies the tarball, so a plugin's install scripts no longer run. Pair that with two credential-leak fixes (a marketplace URL with an embedded https://user:TOKEN@host/... would leak the token into plugin messages, logs, claude plugin marketplace list, and the VS Code plugin dialog) and the plugin story for this release is the same one we have been chasing on every other major release in 2026: the easiest way into a developer's machine is now being slowly closed.
Three other items rise above the long tail. First, Claude apps gateway sign-in now confirms the signed-in account before saving the credential and shows it in /status — same anti-prompt-injection pattern we have seen on Claude.ai and in Claude in Chrome: don't trust a name on the wire, confirm what the gateway actually claims to be. Second, claude.ai skills and plugins now sync into terminal sessions signed in to the same account, with two opt-out switches (syncClaudeAiSkills: false, syncClaudeAiPlugins: false). Third, and operationally important for anyone behind an enterprise LLM gateway or proxy: a class of API Error: 400 failures on every turn — caused by gateways that rewrite API error responses when a beta header is rejected — is closed. If your team has been living with that 400, this is the release to roll onto.
v2.1.276 followed six hours later, 2026-09-18 02:12 UTC. It is a one-line hotfix: v2.1.275 regressed for anyone pointing ANTHROPIC_BASE_URL at a proxy or gateway, returning 400 … Input tag 'advisor_20260301' on every request. v2.1.276 restores the path. So the practical rollout story is deploy v2.1.275 only after v2.1.276 is also in place, and the practical narrative story is: the most material security-relevant items in v2.1.275 are still in v2.1.276; the ANTHROPIC_BASE_URL fix is a transactional one-liner that did not invalidate any of the broader changes.
This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.275 and v2.1.276 release notes. I have not run v2.1.275 against a production harness; treat every operational claim as documentation comparison, not firsthand test. (Release v2.1.275, Release v2.1.276, CHANGELOG.md)
Anthropic shipped v2.1.275 on 2026-09-17 22:33 UTC, then v2.1.276 on 2026-09-18 02:12 UTC as a same-day hotfix. Both releases were quiet — no email, no changelog post. The headline cluster from v2.1.275 is the plugin-supply-chain hardening: npm pack --ignore-scripts plus integrity verification for npm-source plugins, the marketplace-URL credential-leak fix (terminal and VS Code), and the /plugin install <plugin> --marketplace <source> improvement that offers to add the marketplace before installing. The headline operational fix is the API Error: 400 regression for users behind a network gateway that rewrites API error responses when a beta header is rejected — relevant to every enterprise install sitting behind LiteLLM, Portkey, Cloudflare AI Gateway, an in-house proxy, or anything similar. The headline new capability is the bidirectional sync of claude.ai skills and plugins into terminal sessions signed in with the same account, with explicit opt-out switches. The headline anti-prompt-injection fix is the Claude apps gateway now surfaces the signed-in account at sign-in time and on /status, so a malicious gateway cannot silently impersonate a different Claude endpoint and harvest the resulting OAuth token. v2.1.276 is a one-line hotfix restoring ANTHROPIC_BASE_URL proxy support that v2.1.275 regressed; do not run v2.1.275 in production without v2.1.276 either on the same upgrade path or already pinned ahead.
Verbatim from the v2.1.275 release page on GitHub (fetched 2026-09-18 12:09 UTC), grouped by what each item actually does. Roughly 110 bullets, grouped below into the plugin supply-chain cluster (the headline), the gateway sign-in anti-prompt-injection cluster, the claude.ai sync feature, the operational 400-fix cluster, the rest of the new-capability cluster, the long-tail operational sweep, and the VS Code-specific cluster. Cross-referenced to v2.1.276 at the end.
Three items converge into the most material security story in the release. If you install plugins in Claude Code, every one of these affects you.
npm pack --ignore-scripts and integrity-verified, so a package's install scripts no longer run. This is the substantive fix to the plugin supply chain. Pre-v2.1.275, claude plugin install <something-from-npm> ran an npm install against the registry the way npm install <pkg> would, including lifecycle scripts (preinstall, install, postinstall, etc.) declared in the package.json. A malicious npm package — or a compromised package — could ship a postinstall script that ran arbitrary code on every developer who installed the plugin. Post-v2.1.275, Claude Code downloads with npm pack --ignore-scripts (which extracts the tarball but skips lifecycle scripts) and integrity-verifies the result. The functional change is a plugin's postinstall script no longer runs by default; if you actually need a plugin's install scripts to run, that is now a non-default flow and worth a careful look. For any developer or founder pulling plugins from npm this release is the security baseline to pin.claude plugin marketplace list no longer show a password or token stored in a git, ssh or marketplace URL. Pre-v2.1.275, a marketplace URL of the form https://user:TOKEN@github.com/org/repo.git would have the user:TOKEN rendered in plaintext in claude plugin marketplace list, in plugin install error messages, and in the claude plugin log line that the bug-report and /feedback paths emit. The token would land in bug reports, support tickets, and shared screen-shares. Post-v2.1.275, those surfaces redact the credentials. The fix is exhaustive across terminal UI, the marketplace CLI subcommand, and the /feedback//bug output.v2.1.275, the VS Code Manage plugins dialog rendered embedded credentials verbatim, meaning a developer sharing a screen (or a colleague walking up to a desk) could read the token off the dialog. Closed./plugin install <plugin> --marketplace <source> now offers to add the marketplace before installing the plugin. This is the flow improvement that pairs with the URL-credential fix above: the marketplace add path now explicitly distinguishes a missing marketplace from a misconfigured one, rather than auto-failing on a credential-stripped URL and leaving the operator guessing./status shows the signed-in gateway. Same anti-prompt-injection design pattern Claude.ai uses for OAuth flows: the operator confirms the named account before the credential is written. Pre-v2.1.275, a malicious or misconfigured Claude apps gateway could declare any name it wanted during sign-in and the operator would save credentials against that declared identity — handing the OAuth flow to whatever endpoint the gateway claimed to be. Post-v2.1.275, the operator confirms the account the gateway actually presents, and /status exposes the same identifier, so a prompt-injection-driven claim and a real gateway can be visually distinguished./logout for Claude apps gateway sign-ins now also ends the session on gateways that advertise token revocation. Companion fix. Pre-v2.1.275, /logout cleared the local credential but a gateway with a revocation endpoint kept the OAuth grant alive; post-v2.1.275, /logout actively revokes on gateways that support it.syncClaudeAiSkills: false or syncClaudeAiPlugins: false. This is a real new capability: a developer maintaining skills via the Claude.ai web interface now has those skills — and the plugins they have enabled — propagated to every Claude Code terminal session signed in with the same account. Pre-v2.1.275, skill and plugin state was independently maintained on each surface; a feature flagged on claude.ai would not appear in claude --print or the local TUI. Operationally material for any developer managing skills centrally, but also a new default behavior that teams should evaluate against their own configuration policy. The opt-outs are explicit (syncClaudeAiSkills: false, syncClaudeAiPlugins: false in your settings), so a team that wants the terminal behavior to be locally-determined can flip both to false and revert to the pre-v2.1.275 posture.ListPlugins tool description now tells Claude the tool lists plugins enabled on your claude.ai account, not plugins installed locally with /plugin. Companion clarification — under the new sync behavior, the agent's ListPlugins tool returns the synced-from-claude.ai set, not the locally /plugin installed set. The description change is the explicitness the model needs to interpret the result correctly.API Error: 400 fix for users behind an LLM gateway or proxyAPI Error: 400 on every turn for users behind a network gateway that rewrites API error responses when a beta request header is rejected. This was a category-wide failure mode: an enterprise install sitting behind any proxy that intercepts and rewrites the Anthropic API error response (LiteLLM, Portkey, Cloudflare AI Gateway, an in-house gateway with response rewriting enabled, a deep-packet-inspection tool that normalizes error bodies, etc.) would have Claude Code fail every turn with API Error: 400. Pre-v2.1.275, Claude Code assumed the upstream's error response was an unmodified Anthropic response; a rewritten error triggered a transient-vs-permanent parse that misclassified it. Post-v2.1.275, the failure is correctly classified and the call proceeds (or surfaces a meaningful error). For any team that has been living with intermittent API Error: 400 against a proxy, this is the release to roll onto. However: the proxy regression is specifically what v2.1.276 was hot-fixed for — see below.v2.1.276 same-day hotfix (treat as required follow-on to v2.1.275)400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway (v2.1.275 regression). This is a one-bullet, two-sentence hotfix. The release page lists exactly one change. v2.1.275 regressed on the ANTHROPIC_BASE_URL proxy path, breaking essentially every deployment that uses an LLM gateway, an in-house proxy, or any non-api.anthropic.com base URL. v2.1.276 restores the prior behavior. Operationally, do not deploy v2.1.275 standalone; the upgrade path is v2.1.275 → v2.1.276 (or pin v2.1.276 directly, which contains all of v2.1.275 plus the regression fix). The presence of v2.1.276 is also independent evidence the API Error: 400 fix above is real and not a regression — if it had not been real, v2.1.276's rollback of an unrelated beta-header handling path would not have been needed.v2.1.275ctrl+enter, or ctrl+x ctrl+s) that interrupts the current turn and sends all queued messages at once; sent and queued messages show in gray until the model receives them. UX/TUI feature. Operationally useful for any developer using claude --continue long-running sessions that queue messages while a turn is in flight.otelHeadersHelper fails, so sessions that silently export no telemetry are noticed. Observability feature — a Claude Code install pointing at a broken otelHeadersHelper script previously produced no visible signal; now it logs a startup warning.--system-prompt that contains a __SYSTEM_PROMPT_DYNAMIC_BOUNDARY__ line: the text above it is now cached globally, as the SDK's array form already is. Cost/perf feature — if you ship system prompts via --system-prompt that contain the dynamic-boundary marker, this release makes the cache globally shared like the array form already does./desktop error when Claude Desktop does not open now says why and what to do next. UX fix for the claude --desktop flow.matcher no longer fire for every stopping subagent whose agent type was empty. Pre-v2.1.275, an empty-agent-type subagent would match any SubagentStop hook rule with a specific matcher, producing noisy hook firings. Closed./rewind in a forked or background session no longer restores a zero-filled or truncated file when the session's file-history backups could not be fully copied. Reliability fix — v2.1.274's fork-safety work closes the remaining edge case.--drain-wait-sec self-hosted runners now keep the final result of a turn that finished during a SIGTERM drain; the runner now waits briefly for the turn to be reported. Continuation of the v2.1.274 gateway drain work — the same fix applied to self-hosted runners.--resume and --continue no longer drop a conversation's earlier thinking when a built-in tool it started with has since been switched off by a server-side flag. Resumption correctness fix.Claude in Chrome in auto mode skips the extension's per-site check for classifier-approved calls, as bypass mode does, fixing browser_batch "Permission denied" after a redirect. Real-world Claude-in-Chrome fix for auto mode users.The VS Code extension in v2.1.275 adds viewing/editing/deleting a saved memory inside the Memory dialog, sending an attached image without typing any text, a Retry link in the MCP servers dialog when the list fails to load, accept-and-reject buttons under each change in the proposed-change diff tab, and many stability fixes (rewound conversations keeping their permission mode, an empty CLAUDE_CONFIG_DIR setting's workspace fallback, Remote Control turning off correctly, a /remote-control ignored while still connecting now toggling Remote Control off on re-run, scroll-to-bottom toggle claudeCode.scrollToBottomOnSend to disable jump-on-send, etc.). Notably, the credential-leak fix from the terminal-side also reached the VS Code extension's Manage plugins dialog.
v2.1.275 ships substantive peripheral updates to Claude Tag (Amazon CloudWatch / CloudWatch Logs / SNS / Google Cloud Monitoring / Cloud Logging presets, Datadog presets for US3/AP1/AP2/US1-FED, fixed S3 uploads failing through AWS connection with 502, fixed Slack/AWS thread model-revert bugs, fixed Claude [task] display name regressions after session refreshes), Claude Code on the web (a "New routine" button on broken-link pages, cloud environments with too-long allowed-domains lists failing up front with a trims-to-instruction, fixed GitHub-access-denied guidance pointing to the right link), and Code Review (reviews occasionally dropping analysis from mis-formatted review agents, and PRs with 100+ reviews getting a full re-review instead of the lighter merge-focused review). These are all real fixes but they are peripheral to the agent stack.
Five buckets of impact, ranked by who is most affected.
Anyone installing Claude Code plugins from npm (most affected). The npm pack --ignore-scripts + integrity-verified change is the substantive plugin-supply-chain hardening shipped in 2026. Combined with the marketplace-URL credential-leak fixes (terminal claude plugin marketplace list, the /feedback//bug log lines, the VS Code Manage plugins dialog), this release closes three concrete credential-exfiltration paths and one concrete arbitrary-code-execution path. If you install plugins in Claude Code — even one — pin this release after the v2.1.276 same-day hotfix.
Self-hosted Claude apps gateway operators (next most affected). The new sign-in flow's account-confirmation prompt is the substantive anti-prompt-injection fix. If your team operates a Claude apps gateway, you will need to check that the gateway advertises the name your operators see; if your gateway can be trivially impersonated, this release is a forcing function to fix that. /logout also now revokes tokens on gateways that advertise revocation, closing the leftover-OAuth-grant window.
Anyone deploying Claude Code behind an LLM gateway or proxy (next most affected). The API Error: 400 on every turn from proxy response-rewriting is the operational fix. Combined with the ANTHROPIC_BASE_URL regression that v2.1.276 was hot-fixed for, the practical move is to pin v2.1.276 directly (which contains all of v2.1.275 plus the hotfix). If you have been living with intermittent 400s against your proxy, this is the fix that ends them.
Developers maintaining skills and plugins on the Claude.ai web surface (new capability). The syncClaudeAiSkills / syncClaudeAiPlugins sync is a behavior change for terminal sessions signed in to the same Claude.ai account. The opt-out is two settings; if you would rather have terminal-skill state independent of claude.ai web state, flip both to false. If you would rather have terminal sessions auto-pull the latest from claude.ai, leave them at default.
Founders deciding whether to upgrade (yes — pin v2.1.276, not v2.1.275). Three named decisions: (1) do not deploy v2.1.275 standalone; pin v2.1.276 directly; (2) review whether the new claude.ai-sync behavior matches your team's configuration policy; (3) re-test any plugin install flow that relied on package postinstall scripts (the old behavior now requires an opt-in).
Skip if not in scope. If you do not run Claude Code, do not install plugins in Claude Code, do not run a Claude apps gateway, and do not run Claude Code behind an LLM proxy, this release is interesting but not actionable. Catch up on the next pillar.
All capability and security claims above are taken verbatim from the v2.1.275 and v2.1.276 release pages on GitHub, fetched 2026-09-18 12:09 UTC. The v2.1.275 release tag is v2.1.275, atom feed timestamp 2026-09-17T22:33:17Z, authored by ashwin-ant; the v2.1.276 release tag is v2.1.276, atom feed timestamp 2026-09-18T02:12:26Z, authored by ashwin-ant. The v2.1.275 release page body lists approximately 110 distinct change bullets; I have grouped them by what each item actually does, not by the order they appear on the page. The v2.1.276 release page body lists exactly one change. The four bullets in the plugin supply-chain hardening cluster, the three bullets in the gateway sign-in anti-prompt-injection cluster, the two bullets in the claude.ai sync cluster, and the two bullets covering the API Error: 400 fix and the ANTHROPIC_BASE_URL regression hotfix are all taken verbatim from the pages.
This is a documentation comparison, not a firsthand test. I have not installed v2.1.275/v2.1.276 against a production harness. I have not run npm pack --ignore-scripts against an actual plugin. I have not exercised the gateway-sign-in flow under a prompt-injection attempt. I have not measured the API Error: 400 regression under a network gateway. I have not verified the credential-leak redaction across claude plugin marketplace list and VS Code. Treat every operational claim as documentation comparison. Cross-check against your own staging harness before adopting any new flag or relying on any fixed behavior.
Cost. No published price change. The plan-usage read sharing across editor and non-interactive sessions on the same host is a small cost reduction for teams running many sessions. The prompt-cache global sharing for --system-prompt containing the dynamic-boundary marker is a small cost reduction for any deployment using the string form (the SDK array form already had this). The send-now key is a UX improvement with no model-cost delta.
Risk. Three named risk items:
1. Do not deploy v2.1.275 standalone. v2.1.275 regressed for any deployment using ANTHROPIC_BASE_URL against a proxy or gateway. v2.1.276 is a one-line hotfix that restores the path. The safe upgrade path is v2.1.275 → v2.1.276, or pin v2.1.276 directly. A team that rolls v2.1.275 without v2.1.276 will see 400 … Input tag 'advisor_20260301' on every request. 2. The syncClaudeAiSkills / syncClaudeAiPlugins sync behavior changes terminal-side plugin/skill inventory by default. If your team maintains skill and plugin state independently on the terminal vs claude.ai, audit this carefully before upgrading. The opt-outs are explicit and per-flag (syncClaudeAiSkills: false, syncClaudeAiPlugins: false), so the policy is recoverable, but a roll-out that does not pre-decide the policy will leave behavior to whatever the account-level default is. 3. The npm pack --ignore-scripts behavior is a breaking default for plugins that ship postinstall scripts. Any plugin you depend on for an install script needs a deliberate new path or the plugin author needs to update the install flow. The change is for the better (closing the supply-chain vulnerability), but it is a real default flip.
Limitations of this report. I have not installed v2.1.275/v2.1.276 against a production harness. I have not run a plugin install against an npm package with a postinstall script to confirm the new behavior. I have not exercised the gateway sign-in flow under a prompt-injection attempt. I have not measured the API Error: 400 regression under a network gateway. I have not tested the claude.ai-sync behavior across a literal claude.ai ↔ terminal round-trip. Treat every operational claim as documentation comparison.
v2.1.275 is the substantive plugin and gateway release Anthropic shipped late on 2026-09-17, with v2.1.276 as a one-line same-day hotfix. The headline items are positive and security-relevant: the npm pack --ignore-scripts plugin-install hardening, the marketplace-URL credential-leak fixes (terminal claude plugin marketplace list, the /feedback and /bug log lines, and the VS Code Manage plugins dialog), the Claude apps gateway sign-in account-confirmation flow, and the API Error: 400 regression fix that closes the LLM-gateway-proxy failure mode. The new claude.ai sync capability is a real behavior change that warrants a deliberate policy decision; the opt-outs are explicit. The v2.1.276 hotfix is a real release — anyone deploying behind ANTHROPIC_BASE_URL must take it as a coordinated upgrade.
The right roll-forward for a production deployment is: pin v2.1.276 directly rather than v2.1.275; pre-decide whether syncClaudeAiSkills: false and syncClaudeAiPlugins: false belong in your team's settings; if you operate a Claude apps gateway, verify the gateway's name surfaces correctly in the new sign-in flow; and if you operate a private Claude plugin catalog, confirm your plugins no longer depend on postinstall scripts (or extend the install flow to surface them explicitly).
v2.1.275 and v2.1.276 release pages end to end. The plugin-supply-chain cluster is the headline; the gateway sign-in and claude.ai sync are the new-capability cluster. (Release v2.1.275, Release v2.1.276)v2.1.275 rollout target. Pin v2.1.276 directly; do not deploy v2.1.275 standalone because of the ANTHROPIC_BASE_URL regression.syncClaudeAiSkills and syncClaudeAiPlugins. If you maintain terminal-side plugin and skill state independently of claude.ai web state, set both to false in your managed settings. If you want terminal sessions to inherit claude.ai web state, leave both at default.v2.1.276 to a staging harness. Run a 24-hour soak with at least one representative plugin install from an npm source and at least one network-gateway rewrite scenario. Verify the API Error: 400 regression is closed and that the new sign-in flow surfaces the named gateway account correctly.postinstall dependencies. Any plugin that relied on a postinstall script now needs a deliberate install-script path or a plugin-author update./status, which is a deployment signal that should be addressed, not papered over.v2.1.276 in production after staging soak passes. Communicate the deliberate choice on syncClaudeAiSkills and syncClaudeAiPlugins to your team so terminal-side behavior is auditable, not surprising.Originally published: 2026-09-18 12:08 UTC Last verified: 2026-09-18 12:10 UTC (sources fetched 2026-09-18 12:09–12:10 UTC; v2.1.275 release timestamp verified 2026-09-17 22:33 UTC and v2.1.276 release timestamp verified 2026-09-18 02:12 UTC via GitHub atom feed) No corrections at this time.