Anthropic’s Claude Code 2.1.321 makes Claude Fable 5.2 the default model and fixes a vulnerability that could send MCP OAuth secrets to another host after a server redirect. The release also brings a million-token context window and new pricing, alongside a substantial batch of reliability fixes.
Anthropic Watch analysis
What happened
The release notes list Fable 5.2 as the default, with a one-million-token context window, pricing of $8 per million input tokens and $40 per million output tokens, and cache reads at $0.20 per million tokens. Anthropic also adds a –settings option for Remote Control, applying a settings file to each session it starts.
One security fix addresses MCP OAuth requests sending secrets, including refresh tokens, to another host when a server redirected them. The notes also fix cases where Bash commands could run outside the sandbox or file permission checks failed to prompt. Dozens of further fixes cover sessions, file editing, background agents, desktop use and network failures. Anthropic’s Claude Code 2.1.321 release notes give the full list.
Why it matters
Making Fable 5.2 the default changes the model users get without a manual selection, while the stated context limit and prices give developers concrete figures for planning work and spend. The redirect fix is more than housekeeping: OAuth tokens are credentials, and sending them to the wrong host is a security problem. The release notes do not say whether anyone was affected or provide further details about exposure.
Our read
This is a substantial developer release, not just a fresh model name in the picker. The default-model change and credential-handling fix deserve attention; the long tail of repairs may matter just as much to teams whose sessions and tools need to behave predictably. Check the new default and pricing against your workflow, and update if the affected MCP or sandbox behaviours matter to your setup.
What to watch
- Whether Anthropic publishes more detail about the MCP redirect issue and its scope.
- How the new default model and pricing affect Claude Code usage.
- Whether the session, sandbox and Remote Control fixes resolve problems users have encountered.
Discussion spark: Should a credential-handling fix like the MCP redirect issue be enough to prompt an immediate update, even when the release notes give no detail about exposure?
Sources and evidence
- v2.1.321 (9 November 2026, 19:22 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.