Breaking

Claude Code Patched After Leaking Enterprise Gateway Credentials to Anthropic

October 14, 2026 at 17:46 EDT

Security
Sales & Business

Anthropic released Claude Code v2.1.299 on October 14 to patch a security flaw in which third-party gateway API keys were being transmitted to Anthropic servers during routine background requests. The vulnerability affected organizations running Claude Code through an enterprise gateway—a standard architecture pattern for implementing centralized logging, spending controls, and compliance enforcement.

October 14, 2026 · Anthropic

Gateway Credentials Unintentionally Exposed in Routine Requests

Claude Code v2.1.299 patches credential routing to prevent enterprise gateway API keys from being sent to Anthropic during background telemetry and configuration requests.

Exposed Request Types (6 total)

Routine Requests

Feature flags
Startup
Fast mode
Profile
Feedback

Configuration Path

Server-managed settings files with ANTHROPIC_BASE_URL enabled

What Changed in v2.1.299

✗

Before

Gateway credentials sent on 5–6 request types

✓

After

Only Anthropic credentials sent to Anthropic

Enterprise Impact

Organizations running Claude Code behind an enterprise gateway for compliance, logging, and access control should upgrade immediately to isolate gateway credentials from Anthropic's telemetry pipeline.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.