Claude Code v2.1.267 · 9 Sep 2026
Managed-settings-only secDefault flag controls seating of the bundled sec-default plugin
A new managed-settings-only flag lets organizations put their bundled sec-default plugin ahead of user-installed plugin hooks
Use it now Tier: how much it should matter to you
3 Useful: my rating, 1 to 5
3 Signal: worth watching, 1 to 5
Plugins Security Area: what it touches
New Features Kind: in v2.1.267, 09 Sep 26
What probably matters to you Section of the release
What
A new settings field, honored only when set in managed settings (not user, project, local, or --settings ), controls whether the organization's bundled "sec-default" plugin takes the outermost seat in the chain of plugin hooks, ahead of any plugins listed in prependPlugins .
Why
This keeps things like classic hooks, prompt content, managed settings, and tool policy protected from being overridden by plugins that users install themselves, since only an administrator setting managed settings can control this placement.
How sure we are
One source agrees One thing we can check says the same as this entry.
The name it cites is new in this build New in this build: secDefault
See this entry in the whole of v2.1.267 →
9 Sep 2026 · 270 entries, this one is #33.
Use it now38 You'll notice86 Nothing to try yet21 Under the hood125
Open the release →
Names in this entry
setting secDefault A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team/Enterprise accounts
cli --settings Path to a settings JSON file or an inline JSON string. Values you set here override the same keys in your settings.json files for this session. Keys you omit keep their file-based values. The file must be a regular file no larger than 2 MiB. See settings precedence
setting prependPlugins Run your organization's mods before every mod a user installs
Is this right?
0
0
Feedback
What's wrong with this entry?
Hard to understand Too vague Looks wrong Not relevant to me Too long Missing the detail I wanted Duplicate of another card
Clear Learned something new I can act on this Good catch
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
← Previous · 32 of 270
Inbound message ingestion (bridge and CLI stdin) now runs through a session.receive plugin…
Use it now Hooks
In v2.1.267 What probably matters to you release-page order
Next → · 34 of 270
New "ui.message" event added to a second, larger capability/event list
Use it now Plugin UI