Claude Code 2.1.286 fixes four redaction gaps, one opened by an invisible character
Claude Code 2.1.286 fixes four separate cases in which the redaction that is meant to hide secrets did not hide them, including one where an invisible character inside a key name was enough to get a secret printed into logs and transcripts. Anthropic published the release to npm at 17:14:38 UTC on September 30, and it is still the current version.
A Claude Code session running a quality-control analysis on single-cell RNA sequencing data and summarising the results. Image: Anthropic
Anthropic's own changelog records all four among the 88 fixes and changes that make up the release. It calls them fixes rather than vulnerabilities, and attaches no advisory, no CVE and no severity rating to any of them.
The four cases
Two involve error messages. Anthropic fixed "MCP error messages showing a credential's value when 'Bearer' or 'Basic' came before its key name", and separately fixed "percent-encoded Bearer tokens being only partly masked in error messages". Percent encoding is the form a token takes when it is written into a URL, with awkward characters replaced by a percent sign and two hexadecimal digits, and the masking was catching only some of it.
The sharpest of the four turns on a character nobody can see. Anthropic fixed "redacted logs and transcripts showing a secret whose key name has an invisible character inside, such as a zero-width space". A zero-width space occupies no visible width on screen, so a key name carrying one looks identical to a key name without one, and the redaction treated them differently.
A fourth covers passwords embedded in URLs. The fix stops "logs and transcripts showing part of a URL password that contains punctuation such as ')', quotes, ']', '&' or a second '@', or that runs past a '/' to a bracketed host such as '[::1]' in an ssh URL". That one covers credentials kept in a git remote or an ssh URL.
A fifth, related fix is about broken output rather than exposure: "the session transcript in the zip that /feedback saves to disk containing invalid JSON lines after secret redaction".
What the release does not establish
A changelog says what was repaired, not what happened. Anthropic gives no indication of how long any of the four had been present, which earlier versions carried them, whether any of them were reported from outside the company, or whether a single real credential was ever exposed. None of that is published, so none of it should be assumed either way.
What the four fixes do tell a reader is where to look. Each concerns material Claude Code writes down rather than material it sends to a model: error output, local logs, session transcripts, and the zip that the /feedback command saves to disk. If you have shared any of those with a colleague or with Anthropic recently, those are the files in question.
Version discipline
2.1.286 arrived a day after 2.1.285, published at 17:32:09 UTC on September 29, which added a switch to turn off web fetching, and two days after 2.1.284 on September 28. Nothing has shipped since. On npm, 2.1.286 holds the "latest" tag while the "stable" tag still points at 2.1.285, so anyone pinned to stable does not have these fixes yet.
Anthropic has been shipping these roughly daily, and several recent releases have narrowed what the tool is allowed to touch or record, including the one that stopped a symlink sending a write outside your project. Fast releases are the point of the product, and so is reading what each one changed before you update.
