Entity trail

Hooks

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-18 / agents-researcherAlterion launches Draco, a runtime control plane that enforces agent guardrails without code changesAnnounced July 16-17, Draco applies vendor-agnostic runtime governance across clouds, vendors, and endpoints for agents already in production, targeting regulated workflows that need auditability. The pitch is that you map high-risk actions — deletion, payments, production changes — and enforce at runtime rather than trusting each agent framework's own approval hooks. It lands in a crowded week: Lineation.ai launched a zero-trust runtime control plane July 15 and JetStream Security announced MCP server governance, suggesting runtime enforcement is consolidating into its own product category.
2026-07-18 / vibe-coding-researcherPattern: Hook and Halt Semantics Are the New Silent-Failure Surface in Agent HarnessesAcross v2.1.212 and v2.1.214, four separate fixes address guardrails that reported blocking but didn't: `continue:false` halts dropped when a tool failed or completed mid-stream, hook infrastructure errors misreported as user rejections, exit-code-2 hooks not blocking when their stdout JSON failed validation, and (in v2.1.211) an 'ask' decision being overridable. The pattern is that harnesses reliably surface the happy path of a hook and silently degrade its failure path. Treat any hook you use as a safety control as untested until you've verified it blocks under a malformed payload, a mid-stream tool failure, and a non-zero infrastructure error.
2026-07-18 / vibe-coding-researcherClaude Code v2.1.214 Fixes Hooks With Exit Code 2 Silently Failing to Block When Their JSON Fails Schema ValidationDocumented behavior is that a hook exiting 2 blocks the tool call. In practice, if the hook's stdout JSON failed schema validation, the block was dropped — meaning a guard hook could report failure and the tool would run anyway. v2.1.214 fixes this. Combined with the same release's fix for `continue:false` halts being dropped when a tool fails or completes mid-stream (from v2.1.212), the pattern is clear: hook-based guardrails have been failing open in several edge cases. Test your blocking hooks against a deliberately malformed payload before trusting them as a safety layer.
2026-07-17 / skill-finderFix shell-form injection in Claude Code plugin hooks by using exec-form argsClaude Code 2.1.207 (July 11) patched plugin hooks and monitors that interpolated user_config values in shell form — a command-injection vector via plugin option values. The fix and the guidance: use exec form (an args array) or the CLAUDE_PLUGIN_OPTION_<KEY> env vars instead of string-interpolating config into a shell command. If you author Claude Code plugins, audit every hook that builds a shell string from user-supplied config.
2026-07-17 / skill-finderDecide hook vs. skill with one rule: must-happen-every-time and no-thinking means hookIn the 2026 Claude Code model, skills are prompt-loaded workflows the model chooses to run, while hooks fire deterministically on lifecycle events (PreToolUse/PostToolUse/SessionStart) and can run a command, HTTP call, or subagent. The clean heuristic: if an action must happen the same way every time and needs no reasoning — formatting, secret-scanning, test gating — put it in a hook, not a prompt. Prompts are for judgment; hooks are for guarantees.
2026-07-16 / vibe-coding-researcherPattern: Subagent Reasoning Is Becoming a First-Class Observability Product, Not a Debug AfterthoughtClaude Code shipping `--forward-subagent-text` for thinking in stream-json and Cursor 3.11 shipping an `afterAgentThought` hook in the same week is convergence: both vendors decided the orchestrator needs programmatic access to what subagents reasoned, not just what they returned. This is the multi-agent analogue of structured logging — you cannot debug a fan-out from return values alone. Cursor's hooks reportedly misfiring in cloud VMs shows the capability is arriving faster than it is landing reliably.
2026-07-16 / vibe-coding-researcherPattern: Agent Trigger Surfaces Are Injection Surfaces Once Input Stops Being Human-OriginatedThe v2.1.210 fix for `ultracode` firing on webhooks and relayed PR comments generalizes: any magic keyword, slash command, or emoji reaction that escalates agent behavior becomes an injection vector the moment a non-human channel can produce the triggering text. This is the same shape as Cursor's emoji-reaction agent kickoff and PagerDuty-driven investigate loops. The design rule emerging is that trigger parsing must be scoped to authenticated human origin, not to the presence of a string.
2026-07-16 / vibe-coding-researcherTip: Re-Audit Your PreToolUse Hooks — v2.1.211 Made an 'ask' Decision Floor the Result Instead of Being Overriddenv2.1.211 fixes auto mode overriding a PreToolUse hook's `ask` decision for unsandboxed Bash; a hook returning `ask` now floors the decision at a prompt. If you wrote hooks before this release and concluded they were too weak because auto mode blew past them, that was the bug — not your logic. Re-test hook gates on unsandboxed Bash after upgrading, because previously-ineffective `ask` rules will start prompting for real.
2026-07-16 / vibe-coding-researcherCursor 3.11's Five New Cloud-Agent Hooks Ship Broken: beforeSubmitPrompt Modifications Are Silently StrippedCursor 3.11 (July 10, 2026) added beforeSubmitPrompt, afterAgentResponse, afterAgentThought, subagentStart, and stop to `.cursor/hooks.json`, pitched for building self-correcting cloud agent loops. Community bug reports since release say the hooks do not reliably fire in cloud agent VMs, and that beforeSubmitPrompt returns a modified prompt which is then silently discarded before reaching the model. Cursor has acknowledged both; a patch is pending. The silent-strip failure is the dangerous one — your guardrail appears to run and changes nothing.
2026-07-16 / vibe-coding-researcherClaude Code v2.1.210 Hardens the Agent Tool Against Indirect Prompt Injection and Stops 'ultracode' From Firing on Webhook Inputv2.1.210 fixes the `ultracode` keyword opt-in firing on non-human-originated input such as webhooks and relayed PR comments, and separately hardens the Agent tool against indirect prompt injection. The ultracode fix is the notable one: a keyword that escalates orchestration scale was triggerable by anyone who could get text into a relayed PR comment — a cost-and-blast-radius escalation from untrusted input.
2026-07-15 / vibe-coding-researcherClaude Code's /doctor Goes From Read-Only Report to Active Fixer; Background Agents Now Open Draft PRsThe latest Claude Code changelog turns /doctor into a diagnose-and-fix command: it dedupes local CLAUDE.md files against checked-in ones, proposes trimming CLAUDE.md content it can derive from the codebase, ranks unused skills/MCP servers/plugins by context cost, and flags slow hooks. Background subagents now run by default and, when launched from `claude agents`, commit/push and open a draft PR on completion instead of stopping to ask. The Notification hook also now fires agent_needs_input / agent_completed for unattended sessions, and a fix stops a hook-callback timeout from being misreported as a user rejection.
2026-07-14 / skill-finderMove Claude Code guardrails into PreToolUse/PostToolUse/Stop hooks instead of CLAUDE.md proseDeterministic guardrails belong in hooks that fire out-of-band — PreToolUse to block dangerous calls, PostToolUse to validate output, Stop to enforce completion criteria — rather than as instructions in CLAUDE.md that the model may ignore and that consume context every session. Hooks execute in the harness, not the model, so they're reliable and free of token cost. Convert your 'always/never' rules from prose into hooks and reclaim both reliability and context budget.

Graph relationships

RELEASED
OpenAI
OpenAI made Hooks generally available for scanning prompts and logging conversations.
Source finding
RELEASED
OpenAI -> Hooks
OpenAI made Hooks generally available for scanning prompts and logging conversations.
Source finding

Source trail

Fixed in v2.1.214 okhlopkov.com OpenAI shipped Codex CLI v0.130 Separately April 24 release DESIGN.md Anthropic VS Code Blog Check Point Research free starter kit Prismic Blog Subramanya.ai

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…