title: "Claude Code v2.1.281 (Sep 23): Bedrock assume_role + guardrail on the Claude Apps Gateway, claude plugin validate surfaces silently-dropped MCP entries, MCP URL-mode elicitation on the 2026-07-28 protocol, and three security fixes (rm -rf "$(pwd)" blocked in auto mode, macOS /.vol pre-approval traversal, NUL byte in permission rules)" slug: claude-code-2-1-281-bedrock-guardrail-rm-substitution-mcp-validate-sep-2026 date: 2026-09-24 author: Mr. Technology category: AI News type: news source: Original priority: high pillar: false publishedAt: 2026-09-24T16:12:00Z primary_sources:
tags:
claude plugin validate surfaces silently-dropped MCP entries, MCP URL-mode elicitation on the 2026-07-28 protocol, and three security fixes (rm -rf "$(pwd)" blocked in auto mode, macOS /.vol pre-approval traversal, NUL byte in permission rules)On 2026-09-23 at 19:18:58 UTC, Anthropic published Claude Code v2.1.281, the largest stable release in the September series by item count. It lands nine added features and roughly fifty bug fixes. The cluster that actually matters for production operators is four enterprise-or-protocol additions and three security-relevant fixes; the rest of the release is the usual reliability sweep.
This report is a documentation comparison: every feature, fix, and PR-level claim below is sourced verbatim from the GitHub release page for v2.1.281 and the anthropics/claude-code atom feed. No firsthand test was run.
v2.1.281 is distinct from v2.1.280 (Sep 22, covered on this site at /payloads/claude-code-2-1-280-opus-5-5-default-symlink-write-security-mcp-description-cap-sep-2026). v2.1.280 made Claude Opus 5.5 the default and added CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH. v2.1.281 builds on top of it with new gateway configuration, new plugin-validation behavior, new MCP protocol support, and the three security fixes. There is no overlap in the changed-surface between the two releases.
1. Apps gateway support for newer Claude Desktop keys in desktop policy blocks, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode. The desktop policy block now accepts the same settings Claude Desktop ships with, so a Claude apps gateway session can mirror a user's existing Claude Desktop policy exactly instead of being limited to the older enterprise-only subset.
2. assume_role on Claude apps gateway Bedrock upstreams. The gateway calls Bedrock as an IAM role it assumes through STS, in another AWS account if needed, optionally one session per developer. This is the multi-account pattern Anthropic has been hinting at since the Aug Bedrock hardening in v2.1.257: a single Claude apps gateway can now serve developers whose tokens live in separate AWS accounts, with each call scoped to a per-developer STS session.
3. guardrail: {id, version} on Claude apps gateway Bedrock upstreams, documented as "set it on all Bedrock upstreams or none." Every request through those upstreams is filtered through the named Bedrock guardrail. This is the same Amazon Bedrock Guardrails surface customers use for non-Claude models, now wired into Claude Code's gateway.
4. telemetry.resource_attributes on the Claude apps gateway config, putting fixed labels on the telemetry of Claude Desktop and /login sessions. Useful for the SIEM/observability use case Anthropic has been adding across the series (Resource Detection for OpenTelemetry collectors etc.).
5. "attribution": false in settings.json to hide all commit and PR attribution. Notable constraint: older CLI versions skip a settings file that holds the key, so the object form must be used in any file shared across versions.
6. MCP URL-mode elicitation on 2026-07-28 protocol connections — servers can ask Claude Code to open a browser-based flow, and no waiting dialog is left on screen when the server has no way to confirm completion.
7. MCP server checks in claude plugin validate. The validator now reports .mcp.json entries that would be silently dropped at load, undeclared ${user_config.*} references, and insecure URLs. Previously these would fail quietly at session time when the entry tried to load; now they fail loudly at claude plugin validate time.
8. An auto-mode recommendation to /insights that estimates how many permission prompts auto mode could have handled in your recent sessions. New observability surface for teams running auto mode at scale.
9. A scrollbar to /skills, /mcp and /plugin Installed lists in fullscreen mode, like the one /workflows already has. Appears while the mouse is over the list and can be clicked or dragged. UI parity item.
rm -rf "$(pwd)" and other recursive rm whose target is only command-substitution output now prompt, even in auto and --dangerously-skip-permissions mode, even with a Bash allow rule. The opt-out is CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1. Without this fix, an allow rule that matched Bash(rm:*) would have approved rm -rf "$(pwd)" silently. With the fix, Claude Code asks even if the allow rule matches. This is a defense-in-depth item for operators running Claude Code with broad Bash allow rules against rm./.vol, /.nofollow and /.resolve path pre-approval traversal is closed. Permission dialogs and attachment checks now read the path under those macOS synthetic paths (which can resolve to a network mount) only after approval, not before. Previously a malicious file path under /.vol/... could see its network-mount target read before the user approved the access.\u0000 previously matched every path; they now match nothing. This closes a rule-bypass class where a too-permissive match pattern with an embedded NUL would have allowed disallowed actions.Content block not found errors from proxies that drop stream events mid-response are replaced with a kept partial response. Fast mode no longer retries rate-limited requests back to back when the server sends Retry-After: 0. CLAUDE_CODE_RETRY_WATCHDOG no longer fails on the first 5xx after a run of 429/529 waits.Failed to get memory usage after running out of file descriptors; and the headless first-message stall when an SDK MCP host stops responding mid-handshake now waits only a few seconds.claude plugin validate: claude plugin update no longer fails for project-scoped plugins when --scope is omitted — it now resolves the scope the plugin is installed at. claude plugin uninstall no longer refuses to remove a project-scope plugin that isn't enabled. claude plugin validate no longer reports privacyPolicyUrl, supportUrl and other listing metadata keys as unknown fields.@-mentioning a PDF larger than 3 MB no longer adds up to two minutes before responding. An interrupted Read of specific PDF pages no longer leaves its page render running for up to two minutes.rm -rf recursive-with-substitution prompted: covered above under security fixes. The accompanying fix to claude --bg runs project hooks only in directories that have passed the workspace trust prompt — or exits if not run interactively.--setting-sources (and SDK settingSources) are now forwarded to spawned sessions: teammates, /bg, claude agents sessions, --worktree --tmux all start with the parent's restriction.gcpAuthRefresh/awsAuthRefresh login processes are no longer left running (and holding their localhost callback port on Windows) when Claude Code exits or the refresh times out.The Bedrock assume_role and guardrail items together change the calculus for anyone running Claude Code behind a centralized gateway at an enterprise that uses multiple AWS accounts or has standardized on Bedrock Guardrails. Previously, multi-account Bedrock access required per-developer long-lived credentials in each account, or a single shared role trusted across the org — both common, both painful from a security-audit perspective. Now the gateway assumes a STS role per developer, with one session per developer if requested, and Bedrock Guardrails apply uniformly.
The claude plugin validate MCP checks fix the silent-drop class that catches plugin developers by surprise. If your plugin's .mcp.json references a server that won't actually load — wrong shape, undeclared ${user_config.*}, insecure URL — claude plugin validate now tells you before the user installs it. If you ship plugins for Claude Code, this release is the one that should appear in your release notes.
MCP URL-mode elicitation on the 2026-07-28 protocol is the new capability for MCP server authors who want Claude Code to handle OAuth-style or browser-redirect flows as part of a tool call. The "no waiting dialog left on screen when the server has no way to confirm completion" detail matters for server authors who build best-effort flows: the previous UX would have stranded the user on a modal with no path forward.
The security fixes are individually narrow but in aggregate tighten the auto-mode and permission-rule surface. The rm -rf "$(pwd)" block matters for any team that runs Claude Code with Bash(rm:*) allow rules. The macOS /.vol/.nofollow/.resolve path pre-approval block matters for any team running Claude Code on macOS that processes files from external sources. The NUL-byte-permission-rule block matters for any team whose rule-authoring pipeline can produce NUL bytes (e.g., shell expansions hitting bad input).
The prompt-cache fixes are the cost angle. If your team's per-turn cache hit ratio is a meaningful line item in your Claude Code cost model, the resume fix alone is worth the upgrade: a session that previously had to re-prime its cache after a permission prompt (losing the prompt cache from that point) keeps it now.
Verification level: documentation comparison. Primary sources verified verbatim at fetch 2026-09-24T14:09–14:10 UTC:
github.com/anthropics/claude-code/releases/tag/v2.1.281. Release-page body contains nine bullet Added entries and roughly fifty bullet Fixed entries, all captured verbatim in the section above.github.com/anthropics/claude-code/releases.atom, feed <updated>2026-09-23T19:18:58Z</updated>; v2.1.281 entry id tag:github.com,2008:Repository/937253475/v2.1.281, updated 2026-09-23T19:19:15Z./payloads/claude-code-2-1-280-opus-5-5-default-symlink-write-security-mcp-description-cap-sep-2026 confirming v2.1.281 is a distinct release (no shared change set with v2.1.280)./payloads/claude-code-2-1-278-auto-mode-server-side-classifier-no-charge-billing-sep-2026 for the auto-mode observability context around the new /insights surface added in v2.1.281.No firsthand production Claude Code 2.1.281 test was run for this article. All claims are surface-level documentation reproducible end-to-end against the GitHub release page body.
Cost. None directly. None of the v2.1.281 additions or fixes carry a per-request token cost beyond what Claude Code already bills. The prompt-cache preservation fixes are net cost-reducing for resumed sessions; the auto-mode /insights recommendation is a local aggregation with no API cost.
Risk.
assume_role and guardrail features are new knobs; review the gateway config syntax against the AWS IAM and Bedrock Guardrails docs before enabling.attribution: false in settings.json hides commit and PR Claude attribution. If your compliance policy requires Claude contribution disclosure, leave the default.telemetry.resource_attributes sends fixed labels on Claude Desktop and /login telemetry. The labels are operator-controlled, but the destination collector is the configured telemetry endpoint.rm -rf "$(pwd)" security fix is opt-out-able with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1. Do not set this opt-out on a fleet unless you fully understand the prompt-loss trade-off./.vol path-traversal block is set unconditionally; there is no opt-out documented in the release notes.Limitations.
desktop policy-block surface, the bedrock_assume_role config schema, and the guardrail: {id, version} config schema are documented inline on the page but not separately fetched from Claude Code user docs.assume_role documentation on the release page does not enumerate per-AWS-account or per-region support; verify against Bedrock docs in your account before enabling.2026-07-28 MCP protocol connections. Older MCP connections do not get it.user_config references, and insecure URLs. They do not validate that the MCP server actually exists or is reachable at install time.v2.1.281 is the security-and-enterprise release of the September series. The cluster that matters is Bedrock assume_role + guardrail for enterprise gateways, claude plugin validate MCP checks for plugin authors, MCP URL-mode elicitation for MCP server authors, and the three security fixes. The remaining fifty items are the expected reliability sweep; none is a standalone headline, but the prompt-cache fixes are operationally relevant for any team whose cost model assumes a stable cache hit rate across long-running sessions.
The headline risks are narrow and well-flagged in the release notes. The headline opportunity is that any team running Claude Code behind an internal proxy should be able to assume the responsibilities (multi-account STS, Bedrock guardrails) that were previously reserved for direct Anthropic API usage, starting with v2.1.281.
Today 1. If you operate a Claude apps gateway against Bedrock, draft a config change enabling assume_role and guardrail for at least one Bedrock upstream; verify in a dev account first. Refer to the v2.1.281 release page for the inline config schema. 2. If you ship Claude Code plugins, run claude plugin validate against your current marketplace.json and .mcp.json files. Any silently-dropped MCP entries, undeclared ${user_config.*} references, or insecure URLs are surfaced now.
This week 3. Audit your Bash allow rules for rm. If your fleet uses a broad Bash(rm:*) rule, the rm -rf "$(pwd)" block is now active by default; review any automation that relied on silent substitution behavior. Do not set CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 fleet-wide. 4. If you run Claude Code on macOS and accept files from external sources, confirm the /.vol/.nofollow/.resolve path check is in place (it is, by default) and update any pre-approval tooling that read those synthetic paths. 5. If you have an MCP server that wants to drive a browser-based OAuth or interactive flow, evaluate whether your existing server can move to MCP protocol 2026-07-28 and use URL-mode elicitation. The "no waiting dialog left on screen" detail improves the off-the-happy-path user experience.
Skip if not in scope. If you do not operate a Claude apps gateway, do not ship plugins, and do not use macOS pre-approval tooling, the v2.1.281 release is a security-update + reliability-sweep roll-forward. Pick it up on your normal upgrade cadence.
tag:github.com,2008:Repository/937253475/v2.1.281)/insights surface)Verification level: documentation comparison. Every claim above is verifiable verbatim in the GitHub release page body for v2.1.281 and the atom feed entry timestamp. No firsthand test was run against this release.