Claude Code leaked gateway API keys to Anthropic

Claude Code sent third-party gateway API keys to Anthropic's own telemetry servers, a bug closed in version 2.1.246's changelog, released August 25. Anyone routing Claude Code through a proxy, a Bedrock-style gateway, or an internal LLM router had that key travel with every telemetry call to Anthropic. It didn't stay scoped to its own host. Rotate any gateway key used before 2.1.246.

Nothing in the changelog says Anthropic did anything with those keys. That doesn't change the response. A credential that leaves the host it's scoped to gets rotated, the same discipline that applies when a secret turns up in a CI log.

The same release adds a startup warning for Bash allow rules with a wildcard placed before the subcommand. Anthropic's example, Bash(git * main), reads like git something main but also permits git -c core.pager=<anything> ... main. The same bypass shape has been filed against qwen-code and mcp-shell's git aliases.

A second landmine sits in auto mode configuration. The classifier reads autoMode only from ~/.claude/settings.json, managed settings, or --settings, never from a project's .claude/settings.json or .claude/settings.local.json.

The auto mode config docs warn that setting environment, allow, soft_deny, or hard_deny without the literal "$defaults" string replaces the entire built-in rule list. That drops the force-push rule, the curl | bash rule, and the data-exfiltration rules along with it. 2.1.246 auto-inserts "$defaults" for rules added through the new /permissions menu, but it doesn't fix a config edited by hand months ago.

The release also marks subagent output as partial when a run stops at its turn limit, with a hint to continue. Before this, a truncated subagent result looked identical to a finished one. Output collected from a long-running subagent may have been a fragment treated as complete.