Fetching from the wire…
Tools2026-07-18 · source-backed
Documented behavior says a hook exiting 2 blocks the tool call. In practice, if the hook's stdout JSON failed schema validation, the block got dropped and the tool ran anyway. Fixed in v2.1.214, alongside the v2.1.212 fix for continue:false halts being dropped when a tool failed or completed mid-stream. Across two releases, four separate fixes address guardrails that reported blocking but didn't. Harnesses reliably surface a hook's happy path and silently degrade its failure path. Treat any hook you use as a safety control as untested until you've verified it blocks under a malformed payload, a mid-stream tool failure, and a non-zero infrastructure error.
Each link below shares sources, entities, or timing with this story.
Hook if conditions like Bash(cat *) were firing on unrelated Bash commands whenever the command contained $() or backticks followed by more arguments, so existing hook allowlists may have been matching more than you intended. --agents now exits with a clear error on invalid JS...
One line in the v2.1.215 changelog, July 19: Claude Code no longer invokes the /verify and /code-review skills on its own. You call them explicitly now (changelog). If your workflow assumed a review pass fired at the end of a task, it doesn't anymore, and nothing told you. Cod...
This one rearranged my week. An essay published August 4 walks through Databricks' independent benchmark of coding harnesses against its own multi-million-line codebase. Pi, a harness with four built-in tools and a system prompt under 1,000 tokens, paired with Opus 4.8 at xhig...
CVE-2026-27896 (MCP Go SDK): High-severity interpretation conflict in the *official* MCP Go SDK (maintained by Anthropic + Google). Go's encoding/json performs case-insensitive matching — attackers bypass WAFs by sending JSON-RPC messages with non-standard casing the SDK accep...
Go rotate a key. I'll wait. Claude Code 2.1.246, released August 25, lists this in its changelog: a fix for "telemetry and metrics requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); a credential is now only sent to its own hos...
Fixed in 2.1.228; marketplace entries now merge as whole entries rather than field-by-field (Claude Code Changelog). If you override a marketplace in project settings while a user- or enterprise-tier definition exists, auth headers may have been crossing tiers silently. Verify...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.