Claude Code 2.1.257 adds Fable 5.1 and tighter agent safeguards
Claude Code 2.1.257 makes Fable 5.1 the default model and adds stricter controls around metadata access, network paths, credentials, MCP servers, and background agents.
Claude Code 2.1.257 is a substantial client update rather than a small patch. The release makes Claude Fable 5.1 the default Fable model, adds a 1M context window with listed token pricing, and tightens how agent sessions handle credentials, filesystem access, network paths, MCP configuration, and background work.
The npm registry independently lists @anthropic-ai/claude-code at version 2.1.257, with Node.js 22 or newer required. The package metadata confirms distribution of the release; the GitHub release remains the source for the feature and security details.
Claude Code now defaults Fable sessions to Fable 5.1
The release adds Claude Fable 5.1 as the default Fable model, with a 1M context window and pricing listed as $10/$50 per million tokens, plus $0.25 per million cache reads. Anthropic also notes that Claude Apps gateway sessions may continue resolving fable and best to Fable 5 until those gateways are configured for Fable 5.1. Users who need the new model immediately can select Fable 5.1 explicitly in /model.
That distinction matters for teams using gateways or managed deployments: installing the new client does not guarantee that every alias resolves to the new model.
The security boundary gets stricter
Claude Code adds a containment-escape rule that prevents automatic approval of cloud metadata credential fetches, egress evasion, and cross-tenant reach unless the environment marks those actions as expected. It also adds a one-time prompt before the first file read outside configured working directories, with a setting to block those reads.
Other security-related changes cover network paths, credentials, and permission evaluation. Additional directories now reject UNC shares and /net/<host> automounts. Permission rules apply more consistently to shell redirects and reader commands, and plugins can no longer use symlinked component paths to read outside their own directory.
The release also fixes leftover Anthropic credentials being sent alongside Foundry subscription keys, stray authorization or profile headers reaching third-party providers, and remote-control consent being incorrectly counted after dismissal.
Background agents and MCP workflows receive broad fixes
The update fixes background sessions that failed to start, duplicated conversations, lost stashed prompts, or stopped after an interrupted response. Subagents can now continue after sleep, dropped connections, or server errors instead of ending with incomplete work. Stale background binaries and daemon folders also receive cleanup handling.
For MCP users, reconnect and enable operations now respect managed allow/deny lists and strict plugin-only customization. OAuth credentials left behind by claude mcp remove are cleaned up, while logs redact credentials carried in server URLs or request headers.
What to check after upgrading
Teams should verify three things: which model their gateway aliases actually resolve to, whether new outside-working-directory prompts fit their automation policy, and whether managed settings still express the intended permission mode. The release changes behavior at those boundaries, so unattended workflows deserve a short regression run before broad rollout.
The practical impact of 2.1.257 is therefore split between capability and control: Fable 5.1 expands the default model path, while the surrounding safeguards make unattended agent actions more explicit and harder to approve accidentally.
Evidence
Try the related loot
Put six hosted Workers AI models behind Cloudflare AI Search