Claude Code v2.1.292 Update Breakdown: Security Fixes and Plugin System Enhancements

Anthropic's command-line coding assistant Claude Code has released version v2.1.292. This update is notably dense, covering multiple security vulnerability fixes, enhancements to the plugin (mod) system, and improvements to cloud sessions, Slack integration (Claude Tag), and code review tooling. Compared to typical minor version iterations, the security patches in this release deserve particular attention.

Security Fixes Take Center Stage

Looking at the changelog, security-related fixes occupy a substantial portion, and the severity of some issues is not trivial. The most explicitly labeled "Security" fix addresses a case where PreToolUse hook approvals and auto mode could bypass permission prompts when reading files from network (UNC) paths — meaning that in older versions, a malicious or misconfigured setup could allow Claude to read network path files without user confirmation.

Several other fixes also revolve around file access control: a fix for sandboxed commands being able to read staged file copies uploaded to /ultrareview; a fix for a link swap vulnerability on macOS and Windows that allowed notebook or PDF read operations to return files outside the approved scope; and a fix for rm -rf not recognizing Windows home directory paths expressed as 8.3 short filenames or other alternative spellings as home directory deletions.

Another category of fixes addresses policy integrity. For example, a fix for tampered on-disk server management settings caches potentially disabling built-in policy plugins when a settings pull fails. Together, these fixes point in one direction: tightening permission boundaries and preventing bypass of established security policies through path tricks, cache tampering, or hook logic.

UNC paths (Universal Naming Convention) are the path format used in Windows systems to locate network shared resources, typically in the form \\server\share\file. Unlike local paths, UNC paths point to remote file systems on the network, meaning read operations issue network requests and access content potentially controlled by third parties. In security contexts, these paths are a classic attack surface: an attacker can place a crafted file at a network location to trick a tool into reading it, bypassing permission checks designed only for local paths. 8.3 short filenames (also known as DOS filenames) are another path representation that Windows retains for backward compatibility — for example, C:\PROGRA~1 is equivalent to C:\Program Files. Since permission checks may only recognize standard long paths, attackers can use the 8.3 format to bypass blacklist rules targeting specific paths — the rm -rf recognition issue fixed here falls squarely into this category.

Plugin (Mod) System Gets Deep Enhancements

This version invests heavily in plugin development capabilities, signaling that Anthropic is treating Claude Code's extensibility as a strategic priority.

New Capabilities

The update adds a --marketplace <source> option to claude plugin install, which checks and adds a marketplace source using the same policy as marketplace add before installing from it, streamlining plugin distribution. The Agent tool gains an effort parameter, allowing developers to run sub-agents at a specified effort level. Additionally, the prompt.autocomplete event lets plugins add custom entries to the prompt's autocomplete list, while $.model.complete introduces prompt caching — enabling cache behavior by setting cache: true on text blocks.

Prompt Caching is an optimization mechanism that reduces the cost of repeated inference. When an API call contains large fixed-content sections (such as system prompts, long documents, or tool definitions), the model server can cache the computation results for that content. Subsequent requests that hit the cache skip the corresponding processing steps, reducing both latency and token costs. In plugin development scenarios where sub-agent calls frequently reuse the same context prefix, the benefits of prompt caching are especially significant. The cache: true flag introduced to $.model.complete lets plugin developers declare at the text-block level which content is suitable for caching — directly aligned with Anthropic's API-level cache_control mechanism.

Sub-agents are independent agent instances dispatched to execute specific sub-tasks outside the main conversational agent. In complex automated development workflows, a primary agent often needs to schedule multiple sub-agents concurrently or sequentially to handle compilation, testing, retrieval, and other tasks. The new effort parameter allows developers to specify the computational effort level for different sub-tasks, balancing speed against quality.

Stability and Behavior Fixes

The number of plugin-related fixes is substantial, focused on resolving a range of edge cases during hooks worker restarts — such as tool calls skipping permission hooks during worker restarts, plugin interface calls bypassing other plugins' hooks, and next(e) rejection logic being incorrectly treated as a failure. These issues are critical to the reliability of the plugin ecosystem, as they directly affect whether permission controls and guard hooks can be triggered consistently.

Validation logic for claude plugin validate and claude plugin test has also been tightened: failing expect assertions or stub answers rejected by the engine now explicitly cause tests to fail rather than silently passing.

Cloud Sessions and Collaboration Tool Improvements

The cloud sessions section fixes several issues affecting usage continuity: containers forgetting the client's thinking settings after a restart, large session transcripts potentially re-requesting permissions after approval, and scheduled tasks and queued notifications being lost during message retries or edits. The update also improves the post-restart recovery experience — Claude is now informed which stopped background agents can be resumed by ID.

Slack Integration (Claude Tag)

The enterprise-facing Slack integration also sees several adjustments. A fix addresses Claude's replies in Slack threads being hung while an initial request is in progress; another fix resolves threads awakened only by GitHub PR activity or routine tasks remaining on the old model after an admin changes the default. The @Claude !status command is improved to explain why Claude has stopped reading un-@mentioned messages and how to re-enable it.

Code Review

Code review analytics now include total weekly volume and week-over-week changes, as well as per-repository breakdowns. A fix resolves queued review failures when a PR moves to a new base branch and the old branch is deleted, and another correction addresses reviews ignoring CLAUDE.md rules when a PR edits that file — they now use the rules from the base branch version instead.

Performance and Experience Improvements

Beyond fixes, the update brings several experience improvements. Startup speed for claude -p and SDK sessions is improved — the first conversation turn no longer waits for HTTP and SSE-based MCP servers to respond to resources/list. Rendering speed for long list (bulleted or numbered) responses is significantly faster, with support for quicker streaming output, scaling, and reopening in transcripts.

There is one noteworthy change at the MCP protocol level: local (stdio) MCP server connections now default to negotiating protocol version 2026-07-28, covering Bedrock, Vertex, and Foundry, with an opt-out via MCP_PROTOCOL_NEGOTIATION=legacy. Interaction details such as vim mode cursor behavior, /add-dir path input, and character drops during fast typing have also been corrected.

MCP (Model Context Protocol) is an open protocol championed by Anthropic that standardizes how AI models interact with external tools and data sources. The protocol manages capability evolution through version numbers — the 2026-07-28 version now negotiated by default is the current latest stable release, bringing updated definitions for interfaces such as resource listing and tool calls. stdio transport (standard input/output) is the primary connection method for local MCP servers: tool processes exchange messages with Claude via stdin/stdout without needing to listen on a network port, making it well-suited for local tool integration in development environments. This change upgrades stdio local servers to the new protocol version by default, while preserving a backward-compatibility path via the MCP_PROTOCOL_LEGACY=legacy environment variable so that existing tools relying on older protocol behavior are not immediately broken.

Summary

v2.1.292 is a release centered on "hardening." It introduces no groundbreaking new features, but closes multiple potential permission bypass paths through a dense set of security fixes, while systematically polishing the robustness of the plugin system. For teams relying on Claude Code for automated development, building plugin ecosystems, or deploying Slack and code review integrations in enterprise environments, upgrading to this version should be a high priority.