Claude Code v2.1.325 fixes a security issue in compressed-response decoding and addresses a broad set of problems affecting permissions, sessions and integrations. For developers, the most useful changes are less about shiny new buttons and more about Claude Code behaving more predictably around credentials, protected files and long-running work.
Anthropic Watch analysis
What happened
Anthropic’s Claude Code v2.1.325 release notes, published on 13 November, list the security fix and a substantial batch of repairs. They also add clearer guidance when an organisation’s policy blocks a request: users are told they can run /rewind and change the message, or run /clear.
Several fixes concern how Claude Code handles tools and sessions. The notes say subagents should now keep their configured model in cases where opusplan or haiku previously caused it to change, and that sessions on many third-party gateways and Foundry should no longer hit a context-length error on every turn instead of compacting. Another fix prevents background sessions started on a claude.ai login from using, and billing, an API key or token from the shell that started the background service.
Our top picks
- A security fix for compressed responses
Anthropic says the release fixes a security issue in how zstd-compressed responses are decoded. - Permission checks get a tighter sweep
The notes list fixes for gaps involving Bash commands, sandbox boundaries, protected files and permission rules. - Background sessions should use the right account
A fix stops certain sessions on a claude.ai login from using and billing credentials inherited from the starting shell. - Subagents keep their chosen model
The release fixes cases where subagents could be moved to the plan-mode model or use the main session’s model to size results. - Fewer context-length dead ends
Sessions on many third-party gateways and Foundry should compact instead of reporting a context-length error on every turn. - Clearer recovery when policy blocks a request
A new line points users towards /rewind or /clear, rather than leaving the next step to guesswork.
Why it matters
These are practical fixes for teams relying on Claude Code across managed permissions, background sessions and third-party infrastructure. The credential and permission changes are especially worth noting because they affect which account pays for work and when a command or file change is allowed. Anthropic’s notes describe the changes, but do not give further detail about the security issue’s scope or whether anyone was affected.
Our read
This is a substantial maintenance release, and the maintenance is doing real work. Security, permission and account-handling fixes are less glamorous than a new model, but nobody wants their coding assistant to improvise about which credentials to bill or which rules to obey. Users should check the notes against the features and integrations they rely on, particularly managed permissions and background sessions.
What to watch
- Whether Anthropic publishes more detail about the compressed-response security issue.
- Whether users of affected gateways and Foundry see the context-compaction fix in practice.
- Whether the permission and background-session fixes resolve the behaviours described in the release notes. Activity teaser Claude Code v2.1.325 fixes a security issue and tackles a long list of permission, session and integration problems. The most consequential changes include tighter command and sandbox checks, plus a fix for background sessions that could use and bill credentials from the wrong account. Anthropic’s release notes also list repairs for subagent model selection and context errors on some gateways. Which matters more in a developer tool: new capabilities, or getting permissions and account handling reliably right?
Discussion spark: Should developer tools prioritise new capabilities, or should fixes to permissions and credential handling take precedence until they are rock-solid?
Sources and evidence
- v2.1.325 (13 November 2026, 20:40 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.