Framework Watch: Claude Code Stops an OAuth Redirect Leaking Tokens, and OpenAI's SDK Stops Calling the Model After a Guardrail Says No

This week's framework changes are mostly about checks that existed but ran at the wrong moment, or against the wrong target. We read release notes, pull requests and source code, and ran none of it.

Claude Code 2.1.321

Released on November 9, 2026 with Fable 5.2 support, this version also carries several security fixes:

OAuth redirects. It fixes "MCP OAuth requests sending secrets such as refresh tokens to another host when a server redirected them". A refresh token sent to the wrong host may let whoever runs that host obtain new access tokens.
Sandbox. It fixes "a case where a read-only Bash command ran outside the sandbox without a permission prompt", and permission checks that "judged a file write from the wrong folder".
Copies and moves. Deny rules and protected-file prompts now apply to the file that a cp or mv into a directory actually writes, not only to the directory named.

The notes do not say how often these cases occurred. Version 2.1.322, the next day, adds fast mode on Vertex AI.

OpenAI Agents SDK and Google ADK

Guardrail timing. Pull request #5644, merged November 9, fixes a case where Runner.run_streamed "could send a model request after a parallel input guardrail had already rejected the input." The runner now checks the recorded verdict before opening each model stream, including retries. Parallel guardrails save time, but a rejected input could still reach the model and cost tokens.
Guardrail records. Pull request #5643 keeps tool guardrail results after an approved tool finishes and the run resumes, so they appear in the final result and its checkpoint. A separate change makes gpt-6-luna the default model for session compaction.
ADK Java routing. A November 9 commit adds an @Experimental ClassifierNode, which routes a workflow on a classifier's answer to one question and passes its input through unchanged. When the workflow is built, it checks that every possible answer has an edge unless a default edge catches the rest. A second fix lets a sub-agent transfer back to its parent in a resumed invocation. Both are unreleased.
ADK Python answers. When a human-input request expects only a string, a typed answer such as 94103, true or null now arrives as text instead of being parsed as JSON. A postcode no longer becomes a number.
Codex migration. A November 10 Codex commit adds a local-only mode for importing Claude Code skills, excluding synced and trashed skill folders.

What remains uncertain. We did not reproduce the fixed bugs, and the release notes give no information about exposure or exploitation. The ADK commits may change before release.

Analysis: Upgrade Claude Code if your team uses MCP servers with OAuth, and rotate refresh tokens for any server you do not control. For guardrails, check whether a rejection actually stops work in progress or only marks the run as failed afterwards. If Jenya's returns assistant at Belgavi's Book Store ran a policy guardrail in parallel with the model, a test that counts model calls after a deliberate rejection would answer that in minutes.

Sources and evidence

Claude Code 2.1.321 fixes MCP OAuth redirects that could send refresh tokens to another host, a read-only command running outside the sandbox, and deny rules missing cp and mv targets. OpenAI's Agents SDK no longer calls the model after a parallel input guardrail rejects input. ADK Java adds an experimental classifier router. Upgrade, rotate exposed tokens, and test that rejections stop work.