Claude Code 2.1.321 fixes MCP OAuth leak and sets Fable 5.2 as default

Anthropic released Claude Code version 2.1.321 on November 9, 2026, patching a security bug in MCP OAuth handling and setting Claude Fable 5.2 as the default Fable model in the CLI and editor integrations, according to the Claude Code changelog.

What changed in version 2.1.321

• The fix closes a bug where MCP OAuth requests could send secrets such as refresh tokens to another host if a server issued a redirect.
• Claude Fable 5.2 (model id claude-fable-5-2) is now the default Fable model, with a 1 million token context window.
• Fable 5.2 is priced at $8 per million input tokens and $40 per million output tokens, with $0.20 per million tokens for cache reads.
• claude remote-control gained a --settings flag that applies a settings file to every session it starts.
• VS Code integration now shows a warning when both an auth token and an API key are set, matching the terminal's existing startup warning.

What it means for people who build with AI

Developers running MCP servers with OAuth were exposed to a real secret-leak vector through redirects, so updating closes a concrete risk rather than a theoretical one. The same release also quietly swaps the default agent model that many teams rely on every day, which means builders should check which Fable model their workflows are actually calling before assuming behavior stayed the same.

Migration and availability

• Saved Fable 5.1 model picks migrate automatically to the fable alias: immediately on Pro and Max plans, and on Team and Enterprise plans once the organization allows it.
• Users can run /model claude-fable-5-1 to switch back to the previous model.
• The release also lists 74 bug fixes and 15 improvements overall, including a faster claude install (2 to 4 seconds) and faster Windows startup.

Sources

• Claude Code changelog - version 2.1.321 (Anthropic, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.