Claude Code 2.1.321 stops MCP sign-in from sending refresh tokens to another host after a redirect
The most serious fix in the release concerns MCP servers that require an OAuth sign-in. Three more fixes cover cases where a shell command or a file write got past a permission check. Claude Fable 5.2 also becomes the default Fable model.
Anthropic released Claude Code 2.1.321 on November 9, 2026, with four fixes to how the tool protects credentials and enforces permissions. The most serious involved MCP servers that require a sign-in: when such a server redirected an OAuth request, Claude Code sent secrets, including refresh tokens, on to the other host. The other three fixes close cases in which a command or a file write skipped a permission check.
The sign-in fix
The Model Context Protocol (MCP) is the standard Claude Code uses to connect a model to outside tools and services. Servers that need a sign-in use OAuth, a scheme in which an application receives tokens instead of a password. A refresh token is the long-lived one an application uses to request new access tokens, so it is among the most sensitive values the tool holds.
According to the release notes, OAuth requests to an MCP server sent secrets such as refresh tokens to another host whenever the server redirected them. Version 2.1.321 fixes that. The notes do not give a vulnerability identifier and do not say whether anyone exploited the flaw.
Permission checks that were skipped
Three fixes concern the rules that decide what Claude Code may do without asking first.
- A read-only Bash command could, in one case, run outside the sandbox, the isolated environment for shell commands, without a permission prompt.
- Bash permission checks could judge a file write against the wrong folder, so no prompt appeared.
- Deny rules and protected-file prompts did not apply to the file that
cpormvwrites when the target is a directory.
Other changes
Claude Fable 5.2, model ID claude-fable-5-2, is now the default Fable model in Claude Code. Anthropic released the model the same day.
The claude remote-control command gains a --settings option that applies one settings file to every session it starts. If that file changes, no new session starts until the command is restarted.
Version 2.1.322, released on November 10, 2026, adds fast mode on Google's Vertex platform in the global, us, and eu regions. When Vertex refuses fast mode, Claude Code falls back to standard speed.
Sources
Once a week, in your inbox
The whole week's news, gathered into one email. No ads, no passing your address on, one-click unsubscribe.
The address is used only for this roundup. It is not sold and not passed to anyone.
Related
OpenClaw 2026.11.2 stops project settings from adding programs to the agent's PATH
OpenClaw's latest patch release adds no features and fixes a set of security problems. The most serious one let a settings file inside a project add programs from that project to the list of directories where the system looks for commands. Two of the fixes change existing behavior, so some setups need to be adjusted.
OpenClawverified
GitHub Copilot now runs in JetBrains Air, and its cloud tasks use a Copilot plan instead of JetBrains credits
Copilot can now be picked as an agent in Air for local and cloud coding work, on an existing subscription. Air administrators can switch it off, but they cannot cap its spending in Air or see its usage in Air's analytics.
GitHubverified
Claude Code 2.1.314 added an instruction not to recreate existing games
Since version 2.1.314, Claude Code ships two sentences telling the model to build original games but not a copy of a specific existing one. Anthropic says the rule applies with Opus 5.5 and follows from its usage policy on intellectual property. Some developers report that work they hold the rights to is being refused.
Anthropicverified