Claude Code Daily Briefing - 2026-09-11

Release Summary

v2.1.268 shipped on 9/10, one day after v2.1.267. This release leans toward fixes rather than new capabilities — most notably the regression that had made third-party endpoints unusable since v2.1.265, plus several corrections to permission rules and secret handling.

Full release notes

New Features & Practical Usage

WebFetch now has a 300-second deadline — CLAUDE_CODE_WEBFETCH_DEADLINE_MS (v2.1.268)

WebFetch used to hang indefinitely against a server that keeps the connection open without ever finishing the response. A fetch now fails after 300 seconds, and you can change that ceiling with CLAUDE_CODE_WEBFETCH_DEADLINE_MS or turn it off entirely by setting it to 0.

# Drop the deadline to 60 seconds so unresponsive sites fail fast
export CLAUDE_CODE_WEBFETCH_DEADLINE_MS=60000

# Setting it to 0 disables the deadline (not recommended)
export CLAUDE_CODE_WEBFETCH_DEADLINE_MS=0

If you run Claude Code from a scheduled job or in CI, even the 300-second default may be too generous — lower it to fit the total time budget for the run. The same release also improved the WebFetch error for localhost and other dotless hostnames so it explains why the URL is refused and suggests curl instead. Full release notes

--json across every claude plugin subcommand (v2.1.268)

claude plugin install, uninstall, update, enable and disable now accept --json, and each row of claude plugin list --json carries errorDetails and noteDetails. claude auth status --json also gained configDirectory, so a script can see exactly which config directory the current session uses.

# Take the install result as JSON and let the script decide whether it worked
claude plugin install my-plugin@my-marketplace --json | jq -e '.success'

# Find out which plugins failed, and why, row by row
claude plugin list --json | jq '.[] | select(.errorDetails) | {name, errorDetails}'

When you automate plugin installs in onboarding scripts or CI, you can now branch on exit codes and JSON fields instead of parsing output meant for humans. Full release notes

Gateway pricing pass-through and gatewayInternalNetworks (v2.1.268)

With pricing: set in a Claude apps gateway’s gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry line up with the actual spend meter. A new gatewayInternalNetworks managed setting also lets administrators allow /login to a gateway from their organization’s own public IPv4 block.

# gateway.yaml
pricing:
  # Clients receive this rate table and use it for /cost
  enabled: true

access_control:
  # Leave this empty and you get a startup warning, plus a one-time warning
  # the first time a request arrives from a public address
  allow_cidrs:
    - 10.0.0.0/8

If you operate a gateway, the first thing to check is whether you left access_control.allow_cidrs empty — that configuration now produces a startup warning. Full release notes

Developer Workflow Tips

Models got better, so it is time to prune accumulated skills and AGENTS.md (9/9)

As coding agents improve, the fine-grained steering and helper procedures that used to be necessary matter less — which makes revisiting your accumulated Skills, AGENTS.md and task prompts more important, not less. Skill descriptions should be short with clear trigger conditions, and a skill that spans several workflows should be structured so that only the documents and scripts actually needed get read.

Blanket instructions like “always read the full documentation” or “always run the tests” in CLAUDE.md and AGENTS.md burn context and slow work down, so it is worth asking, task by task, whether they earn their place. If your repository has crossed ten skills, start by checking whether a single description line is enough to distinguish when each one should fire. GeekNews

35 hours, 79 commits, 1,200 dollars — the trap of long unattended runs (9/11)

A coding agent was handed the job of building a Python implementation with virtual threads and lexical scoping. Over 35 hours it produced 75,000 lines of code across 79 commits — and nothing usable, at roughly 1,200 dollars in API costs. The more interesting observation is that the throwaway style of the short, compressed code the agent wrote to drive its tools bled into the code meant to stay in the repository, leaving hard-to-read tests and hardcoded numbers behind.

The assumption that a longer run produces a better result is a dangerous one. Put explicit time and cost ceilings on unattended runs, and add checkpoints where a human reads the intermediate output and re-aims the work. During review, look not just at whether the feature works but at whether the agent’s disposable coding style has eroded the repository’s conventions. GeekNews

Security & Limitations

Anthropic threat intelligence report — fake Claude Code installers and a market in stolen API keys (9/10)

On 9/10 Anthropic published its fourth threat intelligence report, covering misuse it disrupted between December 2025 and August 2026. The part that hits Claude Code users most directly: sites advertising cheap Claude access shipped client applications spoofing popular AI harnesses — Claude Code among them — that harvested every credential and session token on the machine.

The report frames stolen API keys and session tokens as an objective in their own right for several criminal groups. One actor injected malicious instructions into an AI vendor’s automated evaluation sandbox, obtained the production API keys it held, and then attacked roughly thirty AI companies in about four days using the same technique. Multiple actors also used prompt injection against LiteLLM-based wrapper services to exfiltrate the production keys living in their cloud-hosted container environments.

Three practical checks follow. First, install Claude Code only through official distribution channels. Second, keep production keys out of any file, environment variable or sandbox an agent can read, and enforce them server-side instead. Third, sweep repositories and build artifacts for leftover keys — one group in the report downloaded 1.8 million Android APKs and scanned them for hardcoded secrets. Anthropic

v2.1.268 security fixes — symlink deny-rule bypass and secrets in error messages (9/10)

Deny and ask permission rules on symlinked directories — /etc, /tmp and /var on macOS, /bin on Linux — did not apply when a path was given by its real location; that is now fixed. Two related cases were fixed as well: Bash commands ignoring deny rules written with the symlinked spelling, and Read or Edit deny rules failing to apply when a command the permission checker cannot analyze, such as env -C or eval, appeared on the same line.

Secret exposure was fixed in two places: plugin and marketplace errors that displayed a token or password from a git source URL, and /mcp and /plugin server details, claude mcp list/get, and MCP login errors that showed secrets resolved from ${VAR} placeholders in MCP configs. Separately, a respawned in-process teammate no longer picks up tools or a system prompt from a same-named agent file in a folder you have not trusted.

If your team manages permission rules as path strings, note that this fix can now block commands that previously slipped through — after upgrading, verify the paths you use most. Full release notes

Third-party endpoints failing every turn with HTTP 400 since v2.1.265, fixed in v2.1.268 (9/10)

Setups pointing ANTHROPIC_BASE_URL at a third-party Anthropic-compatible endpoint had every turn fail with HTTP 400 starting in v2.1.265; that is now fixed. The cause was a regex in the Artifact tool’s input schema that those endpoints reject, which caused the request itself to be refused.

The regression ran for three days, from v2.1.265 on 9/8 through v2.1.267 on 9/9, and upgrading to v2.1.268 is the only fix for teams routing through their own gateway or proxy. Coming right after the CLAUDE_CODE_USE_GATEWAY regression covered yesterday, gateway and proxy setups have now been hit twice in a row — if that is your configuration, it is worth putting a smoke test in CI that makes one real call on every release. Full release notes

Claude service status — Cowork on Windows degraded, everything else operational

A direct check of the official status.claude.com shows the “Degraded functionality for Claude Cowork on Windows” incident, opened 9/10 at 15:54 UTC, still in the identified state as of 9/11. A Windows update released September 8 left the Cowork workspace unable to reach the user’s drive, which blocks local command execution; for most users chat and file reading and editing still work. There is no in-app workaround yet, restarting or reinstalling does not help, and Microsoft has a fix in progress.

Everything else is operational. claude.ai, Claude Console, Claude API, Claude Code and Claude for Government all report Operational, and Claude Code itself is not in the blast radius of this incident. If your team runs local work through Cowork on Windows, moving that work to the Claude Code CLI until the fix ships is the practical option. Claude Status

Ecosystem & Plugins

OpenAI opens the Agents API for embedding Codex-based agents in your app (9/11)

The Agents API exposes Codex’s agent execution as an API, with OpenAI handling session management, task coordination, and context compaction and recovery, while the developer specifies tools and the execution environment. You can continue earlier work in the same session, redirect a run mid-flight with additional instructions, or delegate to sub-agents, and you can choose between OpenAI-hosted sandboxes and self-hosted environments.

If you are embedding agents with the Claude Agent SDK, this is a useful point of comparison for deciding whether to own session and context management yourself or hand it to a platform. GeekNews

Cognition ships SWE-2, a coding model close to Fable 5.1 (9/11)

Built by further training the 2.8-trillion-parameter Kimi K3, SWE-2 scores 50.0% on Cognition’s own FrontierCode 1.1 Main evaluation — within 0.9 percentage points of Fable 5.1 — while cutting cost per task by 64%. It focuses on the relevant code to cut unnecessary exploration and repeated reads, and it was trained across several reasoning levels at once by folding cost and elapsed time, not just whether the problem was solved, into the reward.

For teams feeling the cost of coding agents, that is one more option on the accuracy-per-dollar axis — though the benchmark is the vendor’s own, which is worth keeping in mind. GeekNews

Community News

• Shopify returns from React Native to native (9/11): Shopify is moving all of its mobile apps to Swift and Kotlin, because coding agents have sharply lowered the cost of implementing the same feature separately on iOS and Android. The reasoning is not that React Native performed badly — it is that the premise “sharing code is how you reduce development cost” no longer holds. The Shop app went from proof of concept to a fully native release in 12 weeks, and the Shopify app, with more than 300 screens, is expected to ship a converted version within 2026. Rather than translating the codebase in one pass, they built Helix, a staged verification system that runs tests, screen comparisons and code review on each small task — a useful reference for any team handing a large migration to agents. GeekNews
• Anthropic publishes a 2030 economic scenario explorer (9/10): Enter your expectations about how fast AI advances and gets adopted, and the tool shows how the US economy and jobs change by 2030. Instead of asking only whether whole occupations disappear, it models how the tasks that make up a job get assisted or automated and how new tasks appear. Across the three scenarios presented, 2030 GDP comes out 1.6% to 32.4% higher than in a no-AI baseline — but in the scenario with widespread automation, knowledge workers’ wages stagnate or decline. GeekNews

Minor Changes

All of the following are v2.1.268 (9/10) items.

• Sustained high CPU usage is fixed: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high.
• The conversation summary produced by /compact and auto-compact no longer mangles text containing $ sequences.
• CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS now extends SessionEnd hooks that have no per-hook timeout — previously they were still cancelled after 1.5 seconds.
• PermissionRequest hooks now fire in --print mode, and policy-helper warnings now print on headless (-p) runs.
• The task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) are now offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5. Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to use them elsewhere.
• In /plugin, installing, enabling or disabling a plugin now takes effect when you close the menu — /reload-plugins is no longer needed afterwards.
• claude self-hosted-runner --remove-session-state was added (default off), deleting each session’s per-session directories under <base-dir>/_sessions/ when the session ends.
• Auto mode denials are clearer: the message Claude receives now names the rule that blocked the action and asks Claude to try a safer method and finish unrelated work before stopping to ask you.
• --continue and --resume show the conversation immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript.

Recommended Reads

• ‘How software drives people insane’ (9/11): Because anything in software can change — from a screen to the business model — “we could” turns into “we should” and then into “why isn’t it done yet”, and everything becomes urgent. Move a kitchen in a house and the torn-out plumbing is visible; the context switching, regression risk and coordination cost a code change leaves behind are not. Now that agents make changes look cheaper still, the argument that knowing when not to touch something that works is also engineering is worth sitting with. GeekNews
• ‘Every adult was once a child, but few adults remember it’ (9/10): Mathematician Terence Tao argues that even when AI solves a problem, it does not stand in for the learning and insight a person gains along the way, and makes the case for curiosity-driven exploration. Just as children discover “add one” for themselves while playing “name the biggest number”, handing over the answer meets the goal but can remove the pleasure of exploring and learning. As more implementation work goes to agents, this is a useful lens for deciding what your team should still do by hand. GeekNews
• ‘It is not YAML’s fault, but…’ (9/11): The so-called Norwegian problem, where no is read as a boolean, is not behavior the YAML spec requires — the early designers recommended treating scalars as strings by default. A 2002 type-policy change never made it into the implementations, and when Syck entered Ruby’s standard library in 2003 with the old behavior intact, implementation behavior — not the spec — is what set user expectations. If you have ever watched a config file or frontmatter value next to your CLAUDE.md get interpreted as something you did not intend, this traces the cause. GeekNews

Interesting Projects & Tools

• Show GN: Jjan! — a beer-glass widget that fills up with your Claude Code usage (9/11): A macOS widget that keeps Claude Code usage on screen at all times: the fill level is how much you have used, alongside a percentage, the time remaining until the limit resets, and a weekly usage bar. It cross-checks two sources — JSONL files under ~/.claude/projects, deduplicated by message and request ID, and the official usage API queried periodically with credentials from the keychain. Usage, tokens, cost and project paths never leave the machine. If you regularly bump into the weekly limit, it is a straightforward way to keep the reset time in view. GeekNews
• Show GN: tapl — work history and memory kept in a SQLite database inside the repo (9/11): It records requests, plans, tasks, findings and completion history in a SQLite database inside the repository, so that a new session can pick up which decisions were made, why, and how far verification got. It attaches to the agent through MCP and hooks; after installation you keep asking for work in natural language as usual. It currently ships as a Codex integration, but MCP and hooks are a familiar attachment surface in Claude Code too, so the design is worth a look if losing context between sessions is a recurring problem for your team. GeekNews