Claude Code 2.1.268 closes several ways a deny rule failed to apply

A permission rule is only as good as the check that enforces it, and this release repairs the check in four places at once. Anthropic shipped Claude Code 2.1.268 on September 10, 2026 with a changelog that reads, in its first third, like a security advisory: paths that slipped past deny rules, commands the checker could not read, and secrets printed where they should have been redacted.

Rules that did not reach the command

On macOS, /etc, /tmp and /var are symlinks, and on Linux /bin is one. A deny or ask rule written for one of those directories did not apply when the path arrived spelled by its real location, and a Bash command ignored a deny rule written in the symlinked spelling. Both directions are now handled, so the rule applies to the file rather than to the way it was typed.

The second gap is narrower and easier to hit by accident. A Read or Edit deny rule did not apply when a command the permission checker cannot analyze — env -C, eval or similar — sat on the same line. Anything the checker cannot parse is now handled rather than waved through.

Secrets that were printed

Two fixes in the same release stop credentials from reaching the terminal. Plugin and marketplace errors were showing a token or password taken from a git source URL, and /mcp and /plugin server details, claude mcp list and get, and MCP login errors were showing secrets after ${VAR} placeholders had been resolved. A value that lives in an environment variable exists precisely so it does not appear on screen.

• A respawned in-process teammate could pick up tools or a system prompt from a same-named agent file in a folder that was never trusted.
• Local Cowork sessions set to skip all approvals now refuse a local file outside the session's folders, or behind a symlink, instead of reading it without asking.
• Deny and ask rules written for WebFetch no longer cover Artifact reads and updates; an Artifact rule, or WebFetch(domain:claude.ai), is what gates those now.

Third-party endpoints work again

Anyone pointing Claude Code at an Anthropic-compatible endpoint from another vendor through ANTHROPIC_BASE_URL had every turn fail with HTTP 400 from 2.1.265 onward. The cause was a regular expression in the Artifact tool's input schema that those endpoints reject, and it is gone in this build. WebFetch also got a deadline: a server that holds a response open without finishing now fails the fetch after 300 seconds, and CLAUDE_CODE_WEBFETCH_DEADLINE_MS moves or removes that limit.