Claude Code was sending your gateway's API key to Anthropic, and 2.1.299 stops it
Claude Code has been sending the API key you configure for a third-party gateway to Anthropic's own servers on five kinds of routine request, and version 2.1.299 stops it. Anthropic's changelog says the fix covers feature flag, startup, fast mode, profile and feedback requests, and that Anthropic API keys are still sent on them.
Claude Code 2.1.299 was published to npm at 00:23 UTC on October 14. Image: Anthropic
The setting that triggers the behaviour is ANTHROPIC_BASE_URL, which points Claude Code at a proxy or a gateway instead of Anthropic's API. Version 2.1.299 went up on npm at 00:23 UTC on October 14, according to the package registry.
Pointing Claude Code at a gateway is how organisations put it behind their own logging, spend caps and model allowlists. The key that gateway issues is a separate credential from an Anthropic API key, and it is the one those five request types were carrying.
A sixth path runs through managed settings
The same release fixes the server-managed settings request to Anthropic, which was carrying a third-party gateway's API key when a managed settings file set ANTHROPIC_BASE_URL. A managed settings file is the one an administrator or a device-management tool writes rather than the one you edit yourself, so on that path the gateway was chosen by whoever runs the fleet.
Anthropic has published no CVE, no severity rating, no disclosure credit and no date for when the requests started carrying the key.
Two more gateway fixes land in the same release
Gateway users get two unrelated fixes alongside them. Streams through a custom ANTHROPIC_BASE_URL were being aborted after 180 seconds with no data arriving and now wait 300, and a session on a gateway-specific model name was ending with a prompt-too-long error near 200,000 tokens instead of sending the request at all.
Anthropic also fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it. Requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers no longer follow HTTP redirects either, and nor do MCP requests in cloud and self-hosted runner sessions that come back from the session's MCP proxy.
Mixed News covered the previous Claude Code key question on October 2, when Anthropic's own documentation said the mods you install are not sandboxed and can read your API key. The same week brought four fixes to how Claude Code hides secrets it prints.
Stable does not have any of this yet
On October 14 the package's stable tag still pointed at 2.1.287, so a machine pinned to stable keeps the old behaviour. A 2.1.300 build went up on the next channel at 14:27 UTC the same day.
Nothing in the changelog says a gateway key was read, logged or kept. It says those requests carried one, and that from 2.1.299 they do not.
Note: Links to online stores in articles can be so-called affiliate links. If you buy through this link, MIXED receives a commission from the provider. For you the price does not change.