Make background-task notifications explicitly assert that no human input occurred

Claude Code·high signal

Claude Code v2.1.202–206 added a defense against a subtle attack class: background task notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted upon. The underlying vulnerability is that an agent reading its own transcript can be induced to treat text resembling an approval ('the department head approved this') as real authorization. The transferable skill for anyone building an agent loop: any message re-entering the context from a non-human channel should carry an explicit provenance assertion, because absence of a human turn is not self-evident to a model reading a flat transcript.