Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
Version 2.1.246, released August 25, closes the leak and tightens three more permission checks in the same update.
Why now: Every Claude Code version before August 25 sent gateway keys to Anthropic, so the fix protects nothing already leaked, only rotation closes that gap.
Claude Code sent third-party gateway API keys to Anthropic's own telemetry servers, a bug closed in version 2.1.246's changelog, released August 25. Anyone routing Claude Code through a proxy, a Bedrock-style gateway, or an internal LLM router had that key travel with every telemetry call to Anthropic. It didn't stay scoped to its own host. Rotate any gateway key used before 2.1.246.
Nothing in the changelog says Anthropic did anything with those keys. That doesn't change the response. A credential that leaves the host it's scoped to gets rotated, the same discipline that applies when a secret turns up in a CI log.
The same release adds a startup warning for Bash allow rules with a wildcard placed before the subcommand. Anthropic's example, Bash(git * main), reads like git something main but also permits git -c core.pager=<anything> ... main. The same bypass shape has been filed against qwen-code and mcp-shell's git aliases.
A second landmine sits in auto mode configuration. The classifier reads autoMode only from ~/.claude/settings.json, managed settings, or --settings, never from a project's .claude/settings.json or .claude/settings.local.json.
The auto mode config docs warn that setting environment, allow, soft_deny, or hard_deny without the literal "$defaults" string replaces the entire built-in rule list. That drops the force-push rule, the curl | bash rule, and the data-exfiltration rules along with it. 2.1.246 auto-inserts "$defaults" for rules added through the new /permissions menu, but it doesn't fix a config edited by hand months ago.
The release also marks subagent output as partial when a run stops at its turn limit, with a hint to continue. Before this, a truncated subagent result looked identical to a finished one. Output collected from a long-running subagent may have been a fragment treated as complete.
Each link below shares sources, entities, or timing with this story.
Claude Code released SendMessage / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover Anthropic, August, Claude Code, CVE; cite the same source (changelog).
Linked by a graph relationship (Claude Code released SendMessage); both cover August, Bash, Claude Code, Worse; cite the same source (changelog).
Linked by a graph relationship (Claude Code released SendMessage); both cover Auto, Bedrock, Claude Code, Treat; cite the same source (changelog).
Claude Code released SendMessage / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover Anthropic, August, Claude Code, CVE; overlapping topics (claude, code, credential).
Claude Code released SendMessage / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover August, Claude Code, SendMessage; cite the same source (changelog).
Claude Code released SendMessage / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover August, Bash, Claude Code, Never; reported by the same outlet (code.claude.com).
Claude Code released SendMessage / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code released SendMessage); both cover Anthropic, Claude Code, Never; cite the same source (changelog).
Linked by a graph relationship (Claude Code released SendMessage); both cover Anthropic, Bash, Claude Code; cite the same source (changelog).