Claude Code 2.1.176/2.1.177 Upgrade Check: availableModels, Bedrock STS, Remote Control

When Anthropic shipped enforceAvailableModels in Claude Code 2.1.175, it closed the governance gap where the Default model could resolve to a disallowed model. But one bypass remained open: a user or environment could set ANTHROPIC_DEFAULT_OPUS_MODEL (or the Sonnet/Fable equivalent) to redirect an alias pick toward a model outside the allowlist — and the restriction wouldn't catch it. Claude Code 2.1.176, released June 13, 2026, closes that hole and delivers two additional security fixes that matter for teams running managed fleets.

What happened

Three separate fixes in 2.1.176 tighten model governance and provider security:

1. ANTHROPIC_DEFAULT_*_MODEL can no longer bypass availableModels

In 2.1.175, enforceAvailableModels was added to ensure the availableModels allowlist also constrained the Default model selection. However, env-var aliases like ANTHROPIC_DEFAULT_OPUS_MODEL could still redirect a user's alias model pick to a model outside the managed allowlist. In 2.1.176, alias model picks are validated against the allowlist after env-var resolution. Additionally, /fast now refuses to toggle when doing so would switch the session to a model not in the allowlist.

2. Bedrock awsCredentialExport credentials now cached until expiry

For teams using awsCredentialExport to supply AWS credentials, Claude Code was caching those credentials for a fixed 1-hour window regardless of the credential's actual Expiration field. When credentials had a shorter TTL (common for short-lived STS tokens), Claude Code would attempt calls with expired credentials, causing 401 errors in the 1-hour window before cache eviction. The fix caches credentials until their declared Expiration, matching how the AWS SDK handles credential refresh.

3. Remote Control no longer silently switches the session model

A connection from the web or mobile Remote Control interface was overwriting the session's active model without notifying the user or logging the change. In fleet deployments with availableModels restrictions, this could land sessions on a model outside policy. The fix prevents the model assignment on connect from overriding the session's current model.

Why it matters for AI engineering teams

These three fixes complete the model governance story started in 2.1.175. The governance intent of enforceAvailableModels was to ensure that no user or project setting could widen a managed availableModels list. But if env vars could still redirect alias picks outside the list, the constraint was partial. Teams deploying Claude Code to developer fleets via managed settings should upgrade to 2.1.176 to get the full enforcement guarantee.

The Bedrock credential caching fix is operationally significant for teams using IAM role assumption or cross-account STS tokens, where short-lived credentials (often 15–60 minutes) are standard practice. If you've seen periodic authentication errors during long Claude Code sessions under Bedrock, this is the likely cause.

The Remote Control fix matters for any org where Claude Code sessions run under a managed model policy and developers also use the web or mobile Remote Control interface. Before this fix, connecting from Remote Control could silently land the session on a model the managed policy was designed to prevent.

The router/operator angle

For teams using a gateway or routing proxy in front of Claude Code (including via the ANTHROPIC_BASE_URL env var), the env-var bypass fix changes the threat model: it's no longer possible to configure a shell environment that steers traffic to a different model tier without the managed allowlist catching it. This makes the availableModels + enforceAvailableModels combination a reliable cost governance mechanism, not just a soft policy.

For Bedrock operators, the credential caching alignment with the Expiration field removes a class of "works in testing, breaks at hour mark" bugs that were difficult to trace. If your routing layer injects short-lived STS credentials via awsCredentialExport, the behavior is now predictable and matches AWS SDK semantics.

Checklist for managed Claude Code fleets:

• Upgrade to 2.1.176 to activate full availableModels env-var enforcement.
• Confirm your enforceAvailableModels: true managed setting is deployed (2.1.175+).
• If using awsCredentialExport with STS tokens < 1 hour: verify credential TTLs; the fix eliminates the fixed-1h cache so you should see fewer mid-session 401s.
• If using Remote Control with managed model policies: test a fresh Remote Control connection to confirm the session model is not changed on connect.
• Review hook if conditions for Read/Edit/Write tool paths — 2.1.176 also fixes matching for patterns like Edit(src/**) and Read(.env) that were silently failing.

What TheRouter users should watch or try

If you route Claude Code traffic through TheRouter and use availableModels to enforce model tier limits, the 2.1.176 upgrade completes the governance chain from managed settings through env vars. Combined with enforceAvailableModels, your routing policy can now be enforced end-to-end without a bypass vector through shell environment configuration.

For Bedrock routing specifically, the credential caching fix means fewer retry cascades in your routing logs from expired STS tokens. Teams using per-request credential injection (where each session gets its own short-lived token) will see improved session stability.

See the full Claude Code changelog and the prior enforceAvailableModels coverage for context on the 2.1.175 governance foundation these fixes build on.