You connected Claude Code to an MCP server to read support tickets, files, or a knowledge base. That server uses OAuth and may redirect requests. What happens if a redirect sends a token to a different host? In the official Claude Code 2.1.321 release notes, dated November 9, 2026, Anthropic says it fixed MCP OAuth requests sending secrets, including refresh tokens, to another host when a server redirected them. This documents a fix; it does not establish that your account was compromised.

The same release fixes three permission checks: a read-only Bash command that could run outside the sandbox without a prompt, a file write judged from the wrong directory, and deny rules or protected-file prompts missing the file targeted by a `cp` or `mv` into a directory. If you let an agent work in your repository, the practical step is to check its installed version and update—not to assume every MCP server is hostile.

Check the version before your next session

Run claude --version in a terminal. If it reports a version earlier than 2.1.321, update using the channel that manages your install. Anthropic's setup documentation says native installs can use claude update; Homebrew, WinGet, and Linux package managers have their own upgrade commands. Open a new terminal and check claude --version again. At this article's review time, the releases list also showed 2.1.322. A later build that includes the fixes is fine; confirm the notes for your installed channel.

claude --version
claude update
claude --version

On a managed team, do not force a different channel yourself. Anthropic says stable can lag latest by about a week, and organization policy may pin a version. Give your administrator the 2.1.321 release ID and OAuth fix so they can plan the rollout. Desktop apps and extensions may have separate update mechanisms; a different CLI binary on your PATH does not establish their version.

Review what your agent can reach

Run claude mcp list and identify HTTP servers and third-party connectors you configured, who runs them, and whether you still need them. Use /mcp inside Claude Code to check connection state. Never paste tokens into a prompt or support ticket to “test” the issue. If your own records show an unfamiliar server or an unexpected redirect host, pause that connector and review its credentials with the provider. The release notes do not name affected hosts or provide a test for past exposure.

Also review permission rules and protected paths. Anthropic's settings guide explains personal, project, and managed rules, and how /status confirms what loaded. A command such as cp protected_file folder/ writes to a file inside the destination folder; that final path should be subject to policy. If you need to validate a workflow, use a disposable repository and dummy files. Do not use real secrets or turn off safeguards to reproduce a security bug.

Should every token be rotated?

The notes do not establish broad exploitation or show that every MCP token is compromised. If you have evidence of a third-party server you did not trust, an unexpected redirect, or anomalous credential use, investigate the access window and rotate or revoke that token according to its provider. Otherwise record the old version, update, and review your highest-privilege connectors. Prioritize connections that can read private data, incur charges, or write to production systems.

Version 2.1.321 also made Fable 5.2 the default in its model family and changed Remote Control, but this article focuses on the MCP and Bash security controls. I did not reproduce the bug or test an OAuth server; the fix is documented by Anthropic. Your verifiable test is to confirm the version in every environment running Claude Code and check that its connectors and permissions still match your intended access.

Sources

Anthropic, Claude Code 2.1.321 release, November 9, 2026; Anthropic Docs: install and update; Anthropic Docs: settings and permissions. Reviewed November 10, 2026.