Claude Code v2.1.321 makes Fable 5.2 the default and fixes security bugs

Claude Code v2.1.321, published November 9, 2026, adds claude-fable-5-2 and makes it the default Fable model. The model supports a 1M context window and is priced at $8/$40 per million tokens, with $0.20 per million tokens for cache reads.

The release also adds a --settings <file> option to claude remote-control. The option applies a settings file to every session the command starts. If that file changes, no new session starts until you restart claude remote-control.

Most of the release fixes bugs. The most serious one stopped MCP OAuth requests from sending secrets, such as refresh tokens, to another host when a server redirected them. Other fixes address a read-only Bash command that ran outside the sandbox without a permission prompt, and Bash permission checks that judged a file write from the wrong folder. Deny rules and protected-file prompts now apply to the file that a cp or mv into a directory writes. Several fixes also cover network paths such as UNC shares, WSL folders and /net mounts, affecting NotebookEdit and Edit.

Why it matters

The OAuth and sandbox fixes close gaps that could expose credentials or run commands without the expected prompts. Teams that use MCP servers or Bash-heavy workflows have the most to gain from them. The new default model may change both cost and behavior for sessions that do not set a model explicitly.

What to do

Update to v2.1.321 and check which model your sessions use by default, comparing the listed pricing against your budget. If you run claude remote-control with a settings file, restart the command after each edit. Confirm plan inclusions and current pricing on the vendor’s site before making changes for your team.