Claude Code Daily Briefing - 2026-11-10

Release Summary

v2.1.321 arrived on 11/9, just three days after v2.1.319 (11/6). Beyond adding Claude Fable 5.2 as the default Fable model, this release also bundled some heavyweight security fixes: one for MCP servers using redirects to siphon OAuth secrets off to another host, and another for read-only Bash commands that could run outside the sandbox without a prompt.

Full release notes

New Features & Practical Usage

Claude Fable 5.2 added as the default Fable model, hits an all-time-high score of 65 on Artificial Analysis (v2.1.321)

claude-fable-5-2 has been added as the new default Fable model. It supports a 1 million token context window, priced at $8 per million input tokens, $40 per million output tokens, and $0.20 per million cached-read tokens. According to an Artificial Analysis benchmark posted to GeekNews the same day, Fable 5.2 on the Max setting scored 65 on the Intelligence Index, well above the 40-point median for similarly priced models. That performance comes at a clear cost, though: 44.1 minutes per task versus a 12.9-minute median for comparable models, 231.55 seconds to the first response token versus a 13.07-second median, and an average cost of $26.54 per task — all considerably slower and pricier than the competition.

# If you want to keep using Fable 5.1 (saved selections auto-switch to 5.2)
/model claude-fable-5-1

If you’re routing deep-reasoning work to a Fable model, keep in mind that as of v2.1.321 the default has switched to Fable 5.2 — intelligence scores jump significantly, but so do wait times and cost, so pick the model that fits the task at hand. GeekNews · Full release notes

claude remote-control gains a --settings <file> option for applying a settings file per session (v2.1.321)

The settings file you specify with this option applies to every session that claude remote-control spins up, and changes to the file won’t take effect in new sessions until you restart claude remote-control.

claude remote-control --settings ./remote-settings.json

If you’ve been running multiple remote sessions and had to re-specify the same settings for each one, this option lets a single settings file apply consistently across all of them. Full release notes

Developer Workflow Tips

Saved Fable 5.1 selections auto-switch to Fable 5.2 starting with v2.1.321

Pro and Max plans get the switch all at once; Team and Enterprise plans get it on a timeline their organization controls. Either way, a Fable 5.1 model selection saved in a session moves over to Fable 5.2. If you’ve been defaulting to Fable 5.1, your next session may silently switch to the slower, pricier 5.2 instead.

# To keep using Fable 5.1 as before
/model claude-fable-5-1

If you’ve pinned a Fable model for tasks where short responses matter, it’s worth checking whether response times got noticeably slower after upgrading to v2.1.321, and reverting to 5.1 with the command above if needed. Full release notes

To give AI real company context, document your tacit knowledge and assign an owner to verify it (11/9)

The suggestion here is that for AI to answer according to a company’s own standards, information it can’t guess — metric definitions, approval criteria, internal terminology — needs to be written down and wired into the actual tools people use for work. Information that changes often is better served through search or up-to-date lookups than by retraining a model, and questions with a known correct answer should be checked periodically by a designated owner, so knowledge that would otherwise live in one person’s head becomes an organizational asset.

Metric definitions, approval criteria, internal terms  → Document + wire into work tools
Frequently changing information                        → Search/live lookups instead of fine-tuning
Questions with a known answer                          → Periodic verification + assigned owner

If you’ve written company-specific rules into CLAUDE.md or internal skills but felt them go stale over time, it’s worth applying this three-part structure directly to how you maintain CLAUDE.md. GeekNews

Security & Limitations

Claude service status — a 14-minute Fable 5.1 degradation on 11/8, no incidents on 11/9, all services operational as of 11/10

Checking status.claude.com directly: on 11/8 there was an incident of elevated errors on Claude Fable 5.1 requests (08:18-08:32 UTC, about 14 minutes, resolved). 11/9 shows “No incidents reported,” and as of 11/10 every service — including claude.ai, the Claude API, Claude Code, Claude Console, Claude Cowork, and Claude for Government — is marked “Operational.”

If you ran into service errors over the past few days, that incident has already been resolved — so if you’re seeing problems today, it’s worth checking your local setup or network first. Claude Status

Fixed: MCP servers could use redirects to send OAuth secrets to another host (v2.1.321)

Fixed a flaw where, if an MCP server redirected an OAuth request to a different host, secrets like refresh tokens could get sent along to that host too. This meant a server only had to design its redirect intentionally to exfiltrate credentials — a serious risk when working with untrusted MCP servers.

If you’re connecting MCP servers from outside your organization, or servers using custom OAuth, it’s worth upgrading to v2.1.321 to make sure you’re on a version where tokens can’t leak through this path. Full release notes

Fixed: read-only Bash commands could run outside the sandbox without a permission prompt (v2.1.321)

Fixed a flaw where, in certain situations, Bash commands classified as read-only could run outside the sandbox without ever prompting for permission. The sandbox is a core safety mechanism that limits the blast radius of commands Claude Code runs without approval, so this was a significant fix — there was a path where the read-only classification was trusted and the prompt was skipped entirely. The same release also fixes a bug where Bash permission checks misjudged file writes to the wrong folder and failed to prompt, and a bug where writes to directories via cp and mv weren’t subject to deny rules or protected-file prompts.

If you’re running Claude Code in sandbox mode, it’s worth upgrading to v2.1.321 to make sure permission checks for read-only commands and for cp/mv are all working as intended. Full release notes

Ecosystem & Plugins

Show GN: less — a Claude Code agent skill that keeps only content with a clear reason to exist (11/9)

AI-generated writing, code, and UI tends to run long, and this skill doesn’t just shorten it — it strips out everything except content that has a justified reason to be there. It only triggers when you type /less or ask to “make it shorter.” In a dental-office homepage demo, word count dropped from 347 to 71 and page height from 4,753px to 1,999px, while the name, address, hours, phone number, and pricing all stayed intact. Across 10 test cases, the rate of keeping necessary content was 28/30 and 27/30 with the skill versus 10/30 and 7/30 without it — though the author notes there were failure cases where needed sentences got cut along with the rest, and that the sample size is small.

npx skills add heyeuca/less

If Claude Code’s output keeps coming out longer than it needs to be, this skill is worth installing — a single /less trims it down to the essentials. GeekNews

Community News

• Google Gemini’s guidance now says personal Drive files and emails connected to it can be passed to human reviewers (11/10): Google stated back in 2023 that personal content in Gmail, Docs, and Drive wouldn’t be reviewed by humans, but the revised guidance now specifies that connected files and emails may be subject to review. In public testing, Gemini with Connected Apps enabled pulled Workspace data mid-conversation even without explicit @Drive or @Gmail tags, and the results varied wildly — from no lookup at all to an entire file landing in the session. GeekNews
• Meta’s small, efficiency-focused model Muse Ember scored below Claude Haiku 5.5 on real engineering-task evaluations (11/10): Meta pitched it as a lower-cost-per-task option aimed at the kind of repetitive work agents handle — tool calls, coding subtasks, information extraction, long-document processing — and it scored well on several benchmarks, but fell short of Claude Haiku 5.5 on real-world engineering task evaluations. GeekNews

Minor Changes

All items below are from v2.1.321 (11/9).

• Mods that Claude creates during a session now turn on automatically without confirmation in auto mode and bypass mode. This holds even when managed settings have allowUnsandboxedCommands: false or allowManagedDomainsOnly set, though mods still won’t load in dontAsk mode.
• A mod’s own tool calls ($.tool.call, $.mcp.call) no longer trigger permission prompts. This applies even under user-defined ask rules or dontAsk/-p execution, though deny rules and organizational policy still apply.
• Fixed context-usage estimates over-counting tool definitions when the exact token count couldn’t be determined.
• Fixed /compact showing up twice in Remote Control’s web and mobile views.
• Fixed plugin auto-updates and /plugin marketplace updates redundantly re-downloading the same plugin for every worktree or folder in a repo.
• Fixed WebFetch passing a “no response” placeholder to Claude as if it were page content when the model reading the page returned no text — it now fails with a clear error instead.

Recommended Reads

• Writing as a Thinking Tool (11/9): Writing surfaces connections between ideas that stay invisible in your head, along with gaps in things you thought you understood. The author, a computer science researcher, argues that while an LLM can hand you knowledge, it can’t do the thinking needed to complete your own half-formed intuitions — so the act of writing it yourself shouldn’t be skipped. If you’ve been handing more and more drafting and summarizing over to Claude Code, this is a good prompt to reconsider which thoughts still need to be worked out by hand. GeekNews
• How I Deal with AI-Induced Brain Overload (11/9): To cut down on the context burden of running several coding agents at once, this piece describes a personal experiment: recording work tickets as Markdown files alongside the code in Git, letting agents handle research, implementation, and testing, and routing only items that need human judgment into a priority inbox. Handling one ticket’s context at a time and closing it out by returning it to the queue is a useful reference for developers worn out by context-switching across multiple simultaneous sessions. GeekNews

Interesting Projects & Tools

• Show GN: FCaptcha — an open-source CAPTCHA for detecting AI agents automating real browsers (11/10): Instead of solving image or audio puzzles, it analyzes browser signals, input interaction patterns, and proof-of-work together to distinguish non-human agent automation from real users. It offers both a checkbox mode and an invisible mode, is MIT-licensed and self-hostable, and ships with Go, Node.js, and Python servers plus Next.js, Hono, Supabase, and FastAPI examples. GeekNews
• Show GN: Optics Framework — AI self-heal that fixes broken UI test locators with a local 2B model on GPU (11/9): When a locator in a mobile UI test fails to find an element, this self-healing feature sends the failed locator, a list of on-screen items, and a screenshot to an LLM to pick what should have been tapped. A LoRA-fine-tuned version of Qwen3.5-2B performed best, and since it connects to any OpenAI-compatible server, the team validated it running on a small open model on a local GPU. GeekNews