The last full Claude Code roundup on this blog covered v2.1.258 through v2.1.261 (Sept 1-4) — Fable 5.1’s default rollout, a prompt-caching bug that briefly undercut its own headline pricing discount, and a zsh sandbox bypass fix that landed the same week Langflow’s CVE-2026-0768 was being actively exploited in the wild. This week’s batch is smaller — one bug-fix-only release (v2.1.263, Sept 6) plus two same-day releases on September 8 — but it’s still worth a look, because v2.1.265 and v2.1.266 together are a clean, compact example of the pattern this blog keeps returning to: Anthropic ships a fix, finds the fix’s own blast radius within hours, and ships a second, narrower fix rather than letting the regression sit. Verified directly against code.claude.com’s own changelog.
v2.1.265: plugin directories, and another symlink containment bug closed#
The headline feature is --plugin-dir, which now accepts a folder of plugins rather than a single plugin path — every child folder with a valid manifest loads automatically, and plugins added or removed while a session is running are picked up dynamically. That’s a small ergonomics win with an obvious use case: teams that maintain an internal plugin library no longer need to point Claude Code at each plugin individually or restart a session after adding one. Anthropic also added a 1GB cap on tool results saved to disk, with an in-conversation indicator when a saved file was truncated — the kind of unglamorous resource-limit fix that matters more in long-running agentic sessions than in a quick interactive one.
The fix worth pausing on is under “Security & MCP Improvements”: a plugin path containing a backslash could bypass the symlink containment check on macOS and Linux. Read that plainly — a specially-crafted plugin path could route around the check meant to stop a plugin from resolving outside its declared directory, the exact class of bug this blog has tracked repeatedly this year. The CLAUDE.md-poisoning CVE-2026-21852 that prompted Restricted Mode back in August, the Black Hat cross-vendor trust-boundary cluster in early August, and the zsh command-substitution sandbox bypass from the last roundup are all variations on the same underlying problem: agentic tools with filesystem and execution access create a lot of surface area for path-resolution tricks, and closing one variant reliably surfaces another. A backslash-based symlink bypass in the plugin loader specifically is a new instance of that pattern, not a repeat of a previously-fixed bug — plugins are third-party code by definition, so a containment bypass there is closer in severity to the CLAUDE.md-poisoning class than to an ordinary sandbox edge case. Anthropic also fixed a related but lower-severity issue the same release: plugin directories whose names begin with two dots were being wrongly refused as outside the plugin root — a false-positive in the same containment-check code path, not a vulnerability, but evidence the check was under active scrutiny this cycle.
The rest of v2.1.265 is routine reliability work: several prompt-cache-reuse fixes around subagent resumption and agent teammates (a resumed foreground-spawned subagent was changing its tool list and system-prompt prefix, silently busting the cache — the kind of bug that inflates token bills without ever throwing an error), an MCP transport fallback fix (servers configured as http-only that actually speak legacy HTTP+SSE now fall back correctly per the MCP spec instead of never connecting), and a Windows fix for Read/Write/Edit permission rules incorrectly refusing all files when running inside an AppContainer or restricted-token sandbox.
v2.1.266: the same-day self-correction#
Within the same day, v2.1.266 shipped a single fix: CLAUDE_CODE_USE_GATEWAY was forcing Cloud-gateway sign-in even when a user had ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN set for their own proxy or gateway configuration — a regression introduced in v2.1.265 that broke any setup routing Claude Code through a custom LLM gateway. The variable is now ignored unless both of those environment variables are explicitly set.
This is a small bug on its own, but it’s worth naming the pattern rather than skipping past it: this is at least the third time in recent months this blog has caught Anthropic shipping a same-week or same-day correction to its own release (the Bash Read() deny-rule bypass fix that was partially self-reverted three days later in early September, and now this gateway regression fixed within hours). For a tool increasingly deployed in CI pipelines, self-hosted runners, and enterprise gateway configurations — exactly the audience managedMcpServers and --permission-prompts none from the previous roundup were built for — a broken proxy auth path isn’t cosmetic, it’s a hard outage for anyone routing traffic through a corporate gateway. The redeeming detail is the turnaround: same-day, narrowly scoped, no silent workaround required.
Why the turnaround speed is the actual story#
It would be easy to read “two point releases in one day, one of them a regression fix” as evidence of sloppiness. The more accurate read, consistent with how this blog has covered Anthropic’s release cadence all year, is the opposite: a genuinely high release velocity — averaging multiple point releases a week since spring — means regressions are inevitable, and the question that actually matters is how fast they get caught and closed. A backslash-based symlink bypass closed in the same release cycle it was presumably found, and a breaking auth regression closed same-day, is a materially better outcome than either bug sitting open for a week while enterprise gateway users silently fail over to less secure configurations to unblock themselves. Compare that turnaround to the standing watch items this blog tracks on the other side of the industry — a Langflow CVE that took months from zero-day disclosure to active mass exploitation, or CVEs at other coding-agent vendors that remain unpatched at the product level well after disclosure — and the gap in operational discipline is the more durable competitive signal than any single benchmark number.
Sources: Claude Code changelog — Anthropic (primary, direct fetch); this blog’s own prior coverage of Claude Code v2.1.258-261, Restricted Mode / v2.1.248, and the CLAUDE.md CVE-2026-21852 supply-chain attack.