Pattern: Agent Trigger Surfaces Are Injection Surfaces Once Input Stops Being Human-Originated

Claude Code Changelog·high signal

The v2.1.210 fix for `ultracode` firing on webhooks and relayed PR comments generalizes: any magic keyword, slash command, or emoji reaction that escalates agent behavior becomes an injection vector the moment a non-human channel can produce the triggering text. This is the same shape as Cursor's emoji-reaction agent kickoff and PagerDuty-driven investigate loops. The design rule emerging is that trigger parsing must be scoped to authenticated human origin, not to the presence of a string.