Pattern: Trust-Boundary Hardening Now Reliably Breaks Legitimate Non-Human Triggers

Claude Code Changelog·medium signal

v2.1.210 hardened the Agent tool against indirect prompt injection and stopped keyword triggers firing on webhook input; v2.1.214 then had to fix scheduled tasks refusing their own configured prompt as untrusted. This is a repeatable sequence — tighten the definition of trusted input, then spend the next releases re-admitting the automated callers you legitimately own. If you run cron, webhook, or queue-driven agents, expect each injection-hardening release to break one of your triggers, and keep a canary invocation on each entry path so you find out on the release rather than three days into a silent no-op.