Who was affected by the credential bug fixed in Claude Code 2.1.246?

The bug affected anyone pointing ANTHROPIC_BASE_URL at a third-party gateway. Telemetry and metrics requests going to Anthropic carried the API key configured for that gateway rather than leaving it with the gateway. Claude Code 2.1.246 scopes each credential to its own host, so the key travels only to the endpoint it belongs to.

What does the new Auto mode tab in /permissions do?

The Auto mode tab added in Claude Code 2.1.246 shows the classifier rules auto mode consults when it decides which tool calls to approve on its own, and it lets you edit them. Those rules were not viewable from inside a session before this release. The tab sits alongside the existing /permissions views.

Why does Claude Code warn about a rule like Bash(git * main)?

A Bash allow rule with a wildcard before the subcommand also matches options inserted before that subcommand, so Bash(git * main) permits more commands than its author intended. Claude Code 2.1.246 prints a startup warning whenever it finds one. The same release makes malformed commands ending in a dangling && or || always require approval.

What install problems does Claude Code 2.1.246 fix?

Three of them. The curl install script at claude.ai/install.sh no longer fails with a "Raw mode is not supported" error for some Team and Enterprise users with server-managed settings. The claude plugin install command now reports an error instead of exiting silently when known_marketplaces.json is empty or corrupted. And plugin installs no longer fail when plugin.json carries a UTF-8 byte-order mark.

Anthropic · 2026-08-25 · major

Claude Code 2.1.246 — gateway API keys are no longer sent to Anthropic

Claude Code 2.1.246 stops telemetry and metrics requests to Anthropic from carrying the API key set for a third-party gateway, so a credential now only goes to its own host. The release also adds an Auto mode tab to /permissions.

Claude Code v2.1.246 release page on GitHub

A security-heavy Claude Code release: credentials stay on their own host, and auto mode's rules finally get an editor.

Quick facts

Maker	Anthropic
Version	2.1.246
Released	August 25, 2026
Credential fix	A key is only sent to its own host
New in /permissions	Auto mode tab for classifier rules
New startup warning	Bash allow rules with a wildcard before the subcommand

What is it?

Claude Code 2.1.246 fixes a credential-scoping bug. Telemetry and metrics requests sent to Anthropic were carrying the API key configured for a third-party gateway through ANTHROPIC_BASE_URL; a credential is now only sent to its own host. The same release adds an Auto mode tab to /permissions, where auto mode's classifier rules can be viewed and edited.

How does it work?

Two permission changes work together. The new tab exposes the classifier rules auto mode uses to decide what it may run on its own, and a startup warning now flags Bash allow rules that put a wildcard before the subcommand, such as Bash(git * main), because those also match options inserted before the subcommand and so permit more than they appear to. Bash permission checks now also always ask for approval on malformed commands that end in a dangling && or ||.

Why does it matter?

Teams routing Claude Code through a company LLM gateway were handing that gateway's key to a second host on every telemetry call, so the fix lands hardest on platform teams running the agent behind a proxy. The permission work targets a quieter failure: an allow rule that reads narrow but is not. Very large sessions also stop hitting false denials, because the auto mode safety-check deadline now scales with prompt size.

Who is it for?

developers and platform teams running Claude Code

Frequently asked questions

Who was affected by the credential bug fixed in Claude Code 2.1.246?: The bug affected anyone pointing ANTHROPIC_BASE_URL at a third-party gateway. Telemetry and metrics requests going to Anthropic carried the API key configured for that gateway rather than leaving it with the gateway. Claude Code 2.1.246 scopes each credential to its own host, so the key travels only to the endpoint it belongs to.
What does the new Auto mode tab in /permissions do?: The Auto mode tab added in Claude Code 2.1.246 shows the classifier rules auto mode consults when it decides which tool calls to approve on its own, and it lets you edit them. Those rules were not viewable from inside a session before this release. The tab sits alongside the existing /permissions views.
Why does Claude Code warn about a rule like Bash(git * main)?: A Bash allow rule with a wildcard before the subcommand also matches options inserted before that subcommand, so Bash(git * main) permits more commands than its author intended. Claude Code 2.1.246 prints a startup warning whenever it finds one. The same release makes malformed commands ending in a dangling && or || always require approval.
What install problems does Claude Code 2.1.246 fix?: Three of them. The curl install script at claude.ai/install.sh no longer fails with a "Raw mode is not supported" error for some Team and Enterprise users with server-managed settings. The claude plugin install command now reports an error instead of exiting silently when known_marketplaces.json is empty or corrupted. And plugin installs no longer fail when plugin.json carries a UTF-8 byte-order mark.

Try it

Run /permissions in Claude Code and open the Auto mode tab.