Claude Code v2.1.246｜ゲートウェイ用 API キーが Anthropic にも送られていた｜毎日Changelog解説Claude Code v2.1.246 fixes a bug where API keys intended for third-party…

Anthropic has released Claude Code v2.1.246, a patch that addresses a security-relevant bug in how the tool handled API credentials during telemetry transmission. According to a Qiita blog that translates and annotates the official Claude Code changelog, the update fixes a flaw in which an API key configured for a third-party gateway was also being included in telemetry data sent to Anthropic. For teams that route their traffic through custom endpoints, this is worth treating as a meaningful security fix rather than a routine version bump.

The core of the issue involves the ANTHROPIC_BASE_URL environment variable. Claude Code, Anthropic's command-line agentic coding tool, normally communicates directly with Anthropic's API. However, many organizations override the default endpoint by setting ANTHROPIC_BASE_URL to point at a proxy or gateway of their own choosing. This is a common pattern for enterprises that want centralized logging, cost tracking, rate limiting, or the ability to fan requests out to multiple model providers. In those setups, the API key that Claude Code sends is meant for the gateway, not for Anthropic itself.

The bug meant that this gateway-specific key was, in addition to being used for its intended request path, also being attached to telemetry payloads that Claude Code sends back to Anthropic. In practical terms, a credential that a user believed was scoped to their own infrastructure could have been transmitted to a party it was never intended to reach. The changelog framing suggests the exposure was unintentional and tied specifically to the telemetry channel, but the effect is that a secret leaves the boundary the operator assumed it stayed within.

Why this matters comes down to credential hygiene and data governance. Even when a leaked key is only sent to a trusted vendor such as Anthropic, security teams generally treat any credential that traverses an unexpected path as potentially compromised. Depending on internal policy, the appropriate response may be to rotate the affected gateway keys after upgrading. Users who rely on the default configuration and talk to Anthropic directly appear to be less affected, since in that case the key was already destined for Anthropic; the sharper risk falls on those who deliberately separated their gateway credentials from Anthropic's endpoint.

Some background on Claude Code's telemetry helps explain the context. The tool supports an OpenTelemetry-based export mechanism for metrics and events, which organizations can enable to monitor usage, and there are environment variables that govern whether diagnostic and telemetry data is collected and transmitted. Telemetry systems are generally designed to carry aggregate usage information rather than secrets, so the inclusion of an API key in that stream is the kind of leakage that a patch like v2.1.246 is intended to close. Operators who want to minimize what leaves their environment can also review Claude Code's telemetry configuration options directly.

The gateway pattern itself is increasingly common across the AI tooling landscape. Proxy layers such as LiteLLM, Portkey, and Cloudflare's AI Gateway sit between client applications and model providers, and Claude Code is frequently pointed at Amazon Bedrock or Google Vertex AI through similar redirection. Because these setups depend on swapping endpoints and injecting provider- or gateway-specific credentials, they are precisely the configurations where a mismatch between where a key is sent and where it was meant to go becomes a concern. That makes credential handling in tools like Claude Code an ongoing area to watch.

For users, the practical takeaway is straightforward. Anyone who runs Claude Code with a customized ANTHROPIC_BASE_URL and a separate gateway key should update to v2.1.246 and assess whether their keys may have been exposed through prior telemetry transmissions, rotating them if their risk posture calls for it. The fix is a reminder that agentic developer tools accumulate a growing set of secrets and configuration surfaces, and that even well-intentioned telemetry can become a vector for accidental disclosure. As Anthropic continues its rapid release cadence for Claude Code, keeping current with the changelog remains one of the simpler ways to stay ahead of issues like this one.