Anthropic released version 2.1.321 of its coding agent Claude Code on GitHub on 9 November. The changelog does not say how serious the fixed flaws are or whether anyone has exploited them.

Permission and security fixes

When an MCP server redirected an OAuth sign-in request, Claude Code could send secrets to another server. These included the refresh token, which is used to obtain new access without signing in again.

The release also fixed three permission gaps:

• in one case, a read-only Bash command ran outside the sandbox without asking for permission
• in one case, the permission check for a Bash command evaluated a file write from the wrong directory and did not ask for permission
• deny rules and protected-file prompts did not apply to the file that cp or mv wrote into a directory.

cp and mv called by path, such as /bin/cp, now get the same path checks as plain cp and mv.

On the other hand, Claude Code now asks for permission less often. In auto and bypass modes, it enables mods that Claude writes without asking, even if the organisation has set allowUnsandboxedCommands: false or allowManagedDomainsOnly. The mods’ own tool calls trigger no permission prompt, even when the user’s own ask rules would cover them. Deny rules and organisation policies still apply.

Remote Control gains a --settings flag: the settings file it names applies to every session that claude remote-control starts. If the file changes, the command starts no new sessions until it is restarted. The Remote Control client can no longer move a session to another folder.

Fable 5.2 becomes the default

The default Fable model is now Claude Fable 5.2, which Anthropic announced the same day. Its context window is 1 million tokens. Input costs $8 and output $40 per million tokens, and cache reads $0.20 per million. Saved Fable 5.1 selections switch immediately on Pro and Max plans, but on Team and Enterprise plans only once the organisation has allowed the switch. The command /model claude-fable-5-1 restores the old model.

In its announcement, Anthropic said Fable 5.2 produces responses up to 30 per cent faster than Fable 5.1. Even so, the company recommends starting most coding tasks with Opus 5.5. Fable’s safeguards block most cybersecurity tasks, and Opus 4.8 answers blocked queries. Independent evaluator Artificial Analysis ranked Fable 5.2, run at its highest reasoning effort, first in its index among 74 models in the same price class. Within that price class, it was the most expensive per index task ($26.54) and nearly the slowest (46.4 minutes).

Fable 5.2’s fast mode generates tokens up to 2.5 times faster and costs $16 per million input tokens and $80 per million output tokens, Anthropic said. Version 2.1.322, released the next day, brings fast mode to Google Cloud’s Vertex in the global, us and eu regions, but the changelog does not say which models it covers. If Vertex does not allow it, Claude Code uses standard speed.

The Bedrock, Vertex and Foundry connections in Claude apps gateway no longer read the ANTHROPIC_*_BASE_URL environment variables; a different address now goes in the connection’s base_url setting. In policy_mode: layered, the gateway offers more managed MCP servers after the update. Other fixes cover Remote Control, hooks and cloud sessions, among other things.