Claude Code 2.1.268 patches silent deny-rule bypasses and MCP secret leakage
Claude Code 2.1.268 fixes silent security boundary failures via symlinks and shell commands, plus stops MCP configs leaking secrets in plaintext.
If you have configured deny rules in Claude Code to keep sensitive files off-limits, you need to know about version 2.1.268. Two separate bugs meant those rules were silently doing nothing in certain situations, and a third bug was printing your secrets in plaintext. None of them gave any warning that something was wrong.
What was broken
Deny rules failed silently on symlinked paths
On macOS, directories like /etc, /tmp, and /var are symlinks pointing to their real locations under /private. On Linux, /bin is commonly a symlink to /usr/bin. If you wrote a deny rule against the symlink spelling of a path, Claude Code was not applying it when the actual resolved path was used instead. The reverse was also true: a rule written against the real path was ignored when a Bash command referenced the symlinked spelling.
The result was that a rule you believed was protecting a directory simply was not. No error, no warning, no indication that the boundary had been crossed.
env -C and eval let commands slip past deny rules
A separate parsing gap meant that if a Bash command included env -C, eval, or a similar construct that the permission checker could not statically analyse, any deny or ask rule on that same line was skipped entirely. An agent could read or edit a file you had explicitly blocked, as long as the command was structured in a way the checker did not recognise.
Both bugs were present before 11 September 2026. Both are fixed in 2.1.268.
MCP configs were printing secrets in plaintext
Claude Code supports ${VAR} placeholders in MCP server configurations so you can store tokens and passwords in environment variables rather than hardcoding them. Before this release, several commands and error paths were resolving those placeholders and printing the resulting values, exposing secrets in terminal output. The affected surfaces included /mcp, /plugin server details, claude mcp list, claude mcp get, and MCP login errors.
If you use any of those commands and your MCP config references environment variables containing tokens or API keys, the values were visible in output that could end up in logs, shared terminals, or screen recordings.
What this means for you
Update now if you rely on deny rules. The symlink and eval bypasses are the most significant issues here because they undermine the entire premise of permission configuration. If your settings.json has deny rules protecting .env files, credential stores, or sensitive directories, you could not have known whether those rules were working correctly before this patch.
After updating, it is worth reviewing your deny rules against any paths that might involve symlinks, particularly /tmp, /var, and /etc on macOS. Confirm the rules behave as expected with 2.1.268.
Check your MCP setup if you use environment variable placeholders. If you have been running commands like claude mcp list in a shared or logged environment, treat any secrets referenced in your MCP config as potentially exposed and rotate them. Going forward, the fix ensures placeholders are not resolved into plaintext in command output or error messages.
Other changes in this release
A few other fixes are worth knowing about even though they are not security-related.
Third-party endpoint regression fixed. Anyone using ANTHROPIC_BASE_URL to point Claude Code at a non-Anthropic Anthropic-compatible endpoint has been getting HTTP 400 errors on every request since version 2.1.265. The cause was a regex pattern in the Artifact tool’s input schema that those endpoints reject. This is fixed in 2.1.268, so if you are stuck on 2.1.264 or earlier to avoid the breakage, you can now update.
WebFetch now has a timeout. Fetch requests that previously hung indefinitely against a server that never closed its response will now fail after 300 seconds. You can override this with CLAUDE_CODE_WEBFETCH_DEADLINE_MS, or set it to 0 to disable the timeout entirely.
Task tools are now opt-in on newer models. TaskCreate, TaskUpdate, TaskGet, TaskList, and TodoWrite are no longer offered by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, or any model Claude Code does not recognise. If you rely on these tools and are using one of those models, set the environment variable CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to restore the previous behaviour.
How to update
Run npm update -g @anthropic-ai/claude-code or whichever installation method you used. You can confirm the installed version with claude --version.
The full changelog and the GitHub CHANGELOG.md have the complete list of fixes if you want to dig into the detail.