AI 編程工具與安全
Claude Code 2.1.239 Tightens Cloud Agent Egress and Fixes Bedrock Streaming Retries That Caused Double Billing
The new release forces some Claude Code web tool requests through the session network proxy and also fixes issues involving proxied environments, MCP reconnections, and sensitive input handling. It adds a Python SDK migration command, but Anthropic has not disclosed the vulnerabilities’ severity or the scale of impact.
Anthropic released Claude Code 2.1.239 on August 21, focusing not on model capabilities but on networking, credentials, and session reliability in agent execution environments. Claude Code on the web now routes requests from Bash and other tools to non-API `anthropic.com` hosts through the session network proxy, ensuring that enterprise-configured domain allowlists apply to this path. The change targets cloud sessions; third-party analysis suggests it closes a narrowly scoped proxy bypass rather than a vulnerability allowing unrestricted connections to all external domains.
The fix is more direct for Bedrock users: if an intermediary proxy stripped the response’s `Content-Type`, older versions could rerun an originally streaming call in non-streaming mode, causing duplicate billing for each turn. The new release also makes Bedrock SSO credential preflight checks respect `HTTPS_PROXY`, preventing startup from stalling behind a proxy. Remote MCP servers also no longer remain permanently in a failed state after encountering a transient 5xx error midway through a session.
Security-related changes also include preventing content entered into masked login fields from being pasted elsewhere through the kill ring or written to prompt history. Requests denied by organization policy are no longer retried once before failing. Cloud-synced plugins are named using the `name@synced` format and cannot overwrite local plugins with the same name. For agent teams, `ListAgents` now lists teammates available for communication, while Windows gains cross-session messaging support.
The release also adds `/claude-api upgrade` to help Python projects migrate from `anthropic` 0.x to 1.x and fixes a timeout type reference. Engineering teams should check custom proxies, Bedrock gateways, and MCP reconnection tests. However, Anthropic has provided no CVE, evidence of exploitation, or minimum affected version, so these fixes should not all be treated as security incidents known to have been exploited. The subsequent 2.1.240 and 2.1.241 releases list only reliability fixes, but fast-moving deployments should still run regression tests before updating.