Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-09 · high
Version 2.1.265 flags instructions hidden inside someone else's artifact instead of running them, and blocks publishing to connectors it can't verify.
Why now: The change shipped in the 2026-09-09 changelog for Claude Code.
Claude Code's Artifact tool now treats content written by someone else as untrusted input. If that artifact contains embedded instructions, the tool reports them instead of feeding them into the conversation, according to the changelog for version 2.1.265. The same release blocks publishing an artifact when none of the connector tool names it references actually exist.
Both changes target the same failure mode. An agent reads a file it didn't author, then does what that file says rather than what the user asked. It's the setup for prompt injection, and a soft spot in agentic tools generally.
The practical shift matters for anyone building on shared artifacts, or letting Claude Code read output from other users or connectors. Before this release, text inside an artifact could plausibly reach the model as part of the user's own request. Now that path gets flagged and surfaced instead of executed. A publish step naming a connector tool that doesn't exist fails instead of going through silently.
The changelog doesn't say how the tool tells an instruction apart from ordinary text inside an artifact. That matters for anyone trying to predict what gets flagged and what slips through. It also doesn't say whether the connector-name check catches typos or only tools that don't exist at all.
The shape of the fix matches what CapScope has argued for at the harness level: don't let untrusted content reach the model with the same privileges as the user's own words. Claude Code applied that to one tool. Whether it extends to every other place an agent ingests outside content (files, connector responses, tool output) is the open question.
Each link below shares sources, entities, or timing with this story.
This is the paper of the week. arXiv 2607.28871 introduces BSG-VA, which replays every validation command an agent runs across three code states: the original buggy code (B), the candidate patch (S), and the gold developer fix (G). If a test passes in all three states, it neve...
If you've written Claude Code skills with context: fork in the frontmatter, go check them right now. As of the July 22 release, /code-review runs as a background subagent, and any skill declaring context: fork runs in the background by default (release notes). The opt-out is b...
Cursor 3 launched on April 2. Not an update. A full rebuild. The editor is now secondary to what they're calling an agent orchestration workspace. You can run unlimited parallel agents, locally or in the cloud, launch them from your phone or Slack or Linear, and manage them in...
v2.1.218 took dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs, and stopped prompting in plan mode for Bash the static analyzer can't prove read-only. /deep-research also now starts only when you invoke it. Fewer interrupts, but a model...
Anthropic released Claude Fable 5.1 on September 1. Claude Code v2.1.257 made it the default Fable model at 17:53 UTC that day, with a 1M-token context window, $10 per million input tokens, $50 per million output, and $0.25 per million on cache reads (claude-code CHANGELOG). B...
Two things in one release, and only one of them is in the security section. CLAUDE_CODE_SUBAGENT_MODEL used to override the model for every subagent. In 2.1.251 it sets the default instead. An agent definition's model: frontmatter now wins, and so does an explicit per-spawn mo...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.