Claude Fable 5.1 Arrives: Containment Escape Blocks Cloud Credential Fetches by Default

Claude Code 2.1.257 ships two changes at once, and together they matter more than either does alone. The first promotes Claude Fable 5.1 to the default Fable model. The second hardens auto mode with a new Containment Escape rule that blocks cloud metadata-credential fetches by default. If your pipelines run coding agents against cloud infrastructure — AWS, GCP, Azure, or any environment where 169.254.169.254 is reachable — you need to read this before your next deployment.

What Fable 5.1 brings

The new model ID is claude-fable-5-1. It replaces the previous Fable default and ships with a 1M-token context window — the same ceiling as Sonnet 5 and Opus 5, matching the top of the current Claude lineup.

Pricing: $10 / $50 per million tokens (input / output), with cache reads at $0.25 per million tokens. That positions Fable 5.1 firmly below Opus 5 ($15/$75 input/output at standard tier) and above Sonnet 5 ($3/$15). For agentic workloads where you care about instruction-following quality but cannot justify Opus 5 rates on every call, Fable 5.1 is the natural next tier.

If you have hard-coded claude-fable-5-0 anywhere in your routing config, note that TheRouter does not define a generic fable alias — model IDs route by exact match, so your config keeps serving claude-fable-5-0 until you manually update the pinned string to claude-fable-5-1.

What Containment Escape actually does

The Containment Escape rule targets a specific attack class: an agent running inside a cloud VM or container fetching the instance metadata service (IMDS) at 169.254.169.254, using those credentials to move laterally, or reaching across tenant boundaries.

Concretely, these three action categories are now blocked from auto-approval in auto mode:

• Cloud metadata credential fetches — any HTTP request to the IMDS address (169.254.169.254 or equivalent platform addresses on Azure/GCP)
• Egress evasion — network patterns the runtime classifies as attempting to circumvent sandbox egress controls
• Cross-tenant reach — actions that target principals, resources, or storage outside the current session's expected tenant scope

Auto-approval means Claude Code would have silently permitted these actions without pausing for operator or user confirmation. Under 2.1.257, they now trigger a confirmation prompt unless the environment has explicitly declared them expected.

The "marks them expected" mechanism. If your workload legitimately needs IMDS — for example, an agent that rotates short-lived credentials by querying instance role tokens — you can unblock it by adding the relevant action class to your environment's expected-behavior declaration. The exact configuration surface is via your .claude/settings.json or managed-settings policy; the IMDS exception key is documented under permissions.containmentEscapeExpected. Without that declaration, any IMDS fetch now pauses for approval, even in a fully automated pipeline.

Operators running unattended agent jobs that hit IMDS need to either declare the expectation explicitly or refactor the credential acquisition out of the agent's action scope.

CLAUDE_CODE_SUBAGENT_MODEL_FORCE — multi-model governance at scale

Before 2.1.257, a parent agent's model selection did not propagate to its spawned subagents unless each spawn explicitly set it. Agent definitions could override the model. Per-spawn configuration could override it again. The result was that a team setting a policy-compliant model on the main agent had no guarantee that subagents would follow.

The new CLAUDE_CODE_SUBAGENT_MODEL_FORCE environment variable changes that. When set, it applies CLAUDE_CODE_SUBAGENT_MODEL (or the main model if that variable is unset) to every spawned subagent, regardless of per-spawn overrides and agent-definition model fields.

For operators managing cost or compliance: this is the first mechanism that gives a single env-var the authority to lock model selection across an entire agent tree. If your governance policy says all agents in production must use a specific model or tier, CLAUDE_CODE_SUBAGENT_MODEL_FORCE enforces that without requiring changes to individual agent definitions.

The auth header fixes: a silent credential-leak bug

Two related fixes in 2.1.257 deserve operator attention even if they sound like routine housekeeping.

The first: Claude apps gateway was sending stray Authorization or profile headers to Foundry, Vertex, and Bedrock upstreams. Depending on your configuration, this could mean Anthropic-origin credentials leaking into requests destined for your enterprise provider — a different credential chain than you intended, with potential audit trail implications.

The second: in API-key mode with Foundry, the leftover Anthropic API key or auth token was being sent alongside your Foundry subscription key. Two credentials in the same request, only one of which the endpoint should see.

Neither of these caused immediate auth failures in most configurations — which is exactly what makes them worth auditing. If your logs show unexpected Authorization header shapes in the last few weeks, this is the likely cause.

A separate fix also resolves the doubly-listed custom Authorization header that was overriding the configured credential on Bedrock, Mantle, Vertex, and WIF. And the Vertex setup wizard was picking up a leftover Anthropic profile from ~/.config/anthropic, which could silently mix profiles in multi-provider setups.

Routing decision: Fable 5.1 vs. Sonnet 5 vs. Opus 5

With Fable 5.1 now in the lineup, the routing decision for agentic workloads looks like this:

Fable 5.1's cache-read rate ($0.25) is slightly cheaper than Sonnet 5's ($0.30), which matters for pipelines that aggressively use prompt caching on long system prompts. Agents that read a large codebase context once and then run many turns against it will see a modest but real cache-read cost advantage on Fable 5.1 versus Sonnet 5.

For TheRouter users routing through an OpenAI-compatible gateway: the model ID claude-fable-5-1 is available directly via Anthropic as the upstream. If your gateway config uses the generic fable alias and you want predictable routing to 5.1 specifically, pin the version string.

What to audit before your next deployment

Five specific checkpoints for operators running Claude Code in production:

1. IMDS access in your agent pipelines. Run a grep or log search for 169.254.169.254 in your agent output logs from the last 30 days. If it appears, decide whether to declare it expected in your settings or refactor the credential acquisition path.

2. Foundry and Vertex auth header shapes. Check your upstream request logs for unexpected Authorization or profile headers. If you run Foundry in Entra ID mode and have set ANTHROPIC_FOUNDRY_API_KEY, confirm the fix landed — Entra ID upstreams were failing to start in the previous version.

3. CLAUDE_CODE_SUBAGENT_MODEL_FORCE adoption. If your governance policy requires a specific model across all agents, set this variable in your environment config now rather than relying on agent-definition defaults.

4. Model ID pins. If you have claude-fable-5-0 pinned anywhere, decide whether to stay on 5.0 or update to claude-fable-5-1. TheRouter does not define a generic fable alias — pinned model ID strings must be updated manually.

5. Prompt cache cost baseline. If you use Fable-tier models in prompt-cache-heavy pipelines, update your cost models to use $0.25/Mtok cache reads for Fable 5.1 — slightly better than Sonnet 5's $0.30.

Claude Code 2.1.257 is available now. The Containment Escape rule is active by default in auto mode starting from this version.

Sources: Anthropic Claude Code releases, Claude Code 2.1.257 CHANGELOG