# Claude Code 2.1.321 — Fable 5.2 as the default Fable model, MCP OAuth fix

> Claude Code 2.1.321 brings Claude Fable 5.2 into the CLI and closes several permission and token-leak gaps.

- Org: Anthropic
- Date: 2026-11-09
- Category: tool
- Source: https://github.com/anthropics/claude-code/releases/tag/v2.1.321
- Canonical page: https://ai-tldr.dev/releases/anthropic-claude-code-2-1-321/

## In short

Claude Code 2.1.321 adds Claude Fable 5.2 as the default Fable model, lets remote-control apply one settings file to every session, and fixes MCP OAuth sending refresh tokens to another host after a redirect.

## What it is

Claude Fable 5.2 (`claude-fable-5-2`) arrives in Claude Code 2.1.321 as the default Fable model, with 1M context at $8/$40 per million tokens. Saved Fable 5.1 picks move to `fable`, and `/model claude-fable-5-1` switches back. A new `--settings <file>` flag for `claude remote-control` applies one settings file to every session it starts.

## How it works

The security fixes cover MCP OAuth requests that sent secrets such as refresh tokens to another host when a server redirected them, a read-only Bash command that ran outside the sandbox without a prompt, and deny rules that missed files written by `cp` or `mv` into a directory. Fast mode now tries standard speed on the same model first when fast serving is rate-limited.

## Why it matters

Teams that connect MCP servers with OAuth get a fix for a token leak to a redirect target, and sandboxed users get three permission gaps closed. Remote Control users can now pin settings for every session without editing each one.

## Who it's for

Claude Code users, especially teams using MCP servers and Remote Control

## Try it

npm i -g @anthropic-ai/claude-code@2.1.321

## Links

- [Release Notes](https://github.com/anthropics/claude-code/releases/tag/v2.1.321)
- [Repository](https://github.com/anthropics/claude-code)