Claude Code Fixes OAuth Redirects and File Checks

On November 9, 2026, Anthropic released Claude Code 2.1.321 with fixes for an MCP OAuth redirect that could send secrets to another host, a read-only Bash command running outside its sandbox without a prompt, and several file permission and editing checks. These are changes reported in Anthropic’s release notes, not results of our own security tests. If your team uses MCP sign-in, managed file rules, or notebooks on network paths, check those workflows with disposable files after updating.

What changed in 2.1.321

The release notes name distinct failure cases. They do not provide a severity rating, an affected-version range, an exploitation report, or a count of affected users. The checks below are proposed ways to confirm your own setup behaves as intended; they are not claims that we reproduced a flaw.

Area	Behavior Anthropic says it fixed in 2.1.321	Workflow to check
MCP OAuth	A server redirect could cause OAuth requests to send secrets such as refresh tokens to another host.	Sign-in flows for an MCP server that your team trusts and controls.
Bash sandbox	A read-only Bash command could run outside the sandbox without a permission prompt.	Read-only commands under your effective sandbox and permission policy.
Bash file writes	Permission checks could judge a file write from the wrong folder and fail to prompt.	A write whose allow or ask rule depends on the working folder.
Copy and move	Deny rules and protected-file prompts could miss the destination file created by cp or mv into a directory.	Copying or moving a disposable file into a protected test directory.
Network-file editing	Edit could change the first of several matches, replace a whole file when old_string was empty, or edit a notebook as text on network paths. NotebookEdit could delete or overwrite a notebook’s first cell when no cell was named.	Edits on a test UNC share, WSL folder, or /net mount if your workflow uses one.

All five rows summarize the 2.1.321 release notes. They should not be read as a complete list of changes in that release. The notes also contain model, remote-session, plugin, and interface updates; this article focuses on the cases that change a reader’s validation plan.

MCP sign-in and local file rules need separate checks

The OAuth fix concerns where a redirected request sends a secret. The release notes describe a redirect to another host; they do not say that every MCP server or every OAuth exchange had this behavior. For a controlled check, use a test account and an MCP server whose redirect destination your team can inspect. Confirm the expected destination and whether sign-in completes. Keep refresh tokens out of screenshots, logs, and support tickets. A successful sign-in alone does not show which host received each request.

The local permission fixes concern a different boundary. A Bash command may be read-only yet still require a sandbox or a prompt under your policy. A file write can be judged against the wrong folder. For cp and mv, the destination file matters even when the command names only a directory. Start by recording the installed Claude Code version and the effective policy. Then use a temporary directory with an explicit deny or ask rule and a harmless test file. Check the action’s prompt or denial and inspect the actual destination afterward. Do not use a production secret or bypass flag to make the test pass.

This is narrower than a claim that the client is now safe for every command. The release gives examples of corrected behavior, not a proof of the entire permission system. If an administrator manages your rules, have them review the policy and the observed result together.

Network files need a content check

The network-path fixes are easy to mistake for a simple “edit succeeded” check. Anthropic specifically names UNC shares, WSL folders, and /net mounts in the release notes. It also names outcomes that an exit status alone would not reveal: a different match changed, a whole file replaced, or the first notebook cell overwritten.

If your team edits these paths, make a backup or create a disposable fixture first. Put two identical strings in a plain text file, then specify which occurrence should change. Compare the complete before-and-after diff, not only the tool’s success message. For a notebook fixture, record its cell count and first-cell content before the edit, name the target cell explicitly, and compare both afterward. Avoid testing an unspecified-cell edit on a valuable notebook just to reproduce the old behavior.

These are reader-side validation steps, not tests performed by DailyTech. The release does not say that local files had the same failures or that every network mount is affected. The purpose of a fixture is to establish the behavior of your own path and policy without risking an active project.

What to verify before resuming work

Use a small record that a teammate can audit later:

1. Record the installed version with claude --version, the operating system, the path type, and the relevant permission policy. Do not paste credentials or sensitive policy values into a public report.
2. Choose one permitted action and one action your policy should prompt for or deny. Use disposable files and inspect both the response and the resulting filesystem state.
3. For MCP sign-in, confirm the expected redirect host through a controlled test setup. If you cannot observe that path safely, record the check as unverified rather than inferring it from a completed login.
4. For network edits, compare the full diff or notebook cells with the backup. Preserve a sanitized result for the person who manages the workflow.

If an unattended Claude Code job is part of the same workflow, distinguish its finished output from its process status. Our separate guide to unattended Claude Code runs covers the earlier 2.1.319 changes to refusals and exit codes. Anthropic’s IP allowlist announcement concerns network origin for covered Claude requests; it does not validate a local file rule or an MCP redirect. Keeping those controls distinct makes a failed check easier to diagnose.

Version 2.1.321 is a Claude Code client release, not a new model or API price. The AI model tracker tracks model releases, while the API cost calculator estimates a separate API workload from numbers you supply. Neither tool verifies this client patch. For the patch itself, use the official release notes and the result of your own controlled checks.

Sources

• Anthropic Claude Code 2.1.321 release notes — publication date and the documented OAuth, sandbox, file-permission, and network-path corrections.

All pages read on November 11, 2026.

Free toolWhat will 10,000 chats a month cost?Estimate my bill