Skills
Claude Code was sending its Anthropic API key to third-party gateway hosts in telemetry, fixed in 2.1.246
The 2026-08-25 release notes list a fix for "telemetry and metrics requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); a credential is now only sent to its own host." Anyone routing Claude Code through a proxy, Bedrock-style gateway or internal LLM router should treat any gateway key used before 2.1.246 as exposed to Anthropic's telemetry endpoint and rotate it. The same release also stops `--strict-mcp-config` sessions from prompting to approve `.mcp.json` servers they would never load, which had been leaving background sessions hung at startup.
↳ Follow the thread