Anthropic shipped three minor versions of Claude Code on October 14 and 15, 2026β€”2.1.299, 2.1.300, and 2.1.301β€”and each one quietly rewrote how existing hooks behave. No configuration changes were required for these shifts to take effect; they applied the moment developers updated. The changelog entries, buried under "Changed" sections, introduce stricter validation, altered execution timing, and new failure modes that can break production workflows overnight.

Execution Order and Skill Expansion

The most disruptive change in 2.1.299 moves the UserPromptSubmit hook to run before a skill or custom slash command expands. Previously, a blocking hook stopped the prompt but allowed the skill's embedded shell commands to execute. Now, if a hook blocks the prompt, it also prevents those shell lines from running. This breaks any hook logic that relied on searching for text that only appears after skill expansion. Developers must now use the separate UserPromptExpansion event to inspect expanded content.

Strict Input Validation and Permission Handling

Version 2.1.300 introduced rigorous validation for updatedInput from PreToolUse and PermissionRequest hooks. Unknown keys are now dropped, and if the tool rejects the input, the call is denied. This means hooks that previously returned partial objects or added custom bookkeeping keys will fail silently or block actions. Additionally, setMode updates from PermissionRequest hooks are ignored in Cowork cloud sessions, meaning hooks that attempt to switch permission modes like acceptEdits will no longer function as expected in cloud environments.

Agent Tools and Plugin Failure Modes

Agent tools lists in 2.1.299 now strictly match named MCP servers, eliminating previous leaks where prefixes like mcp__a would incorrectly match servers named a__b. If an agent's tool list no longer resolves to any available tools, the subagent fails to launch entirely. Furthermore, plugin hooks that fail to receive or return an answer now refuse the action instead of letting it through. If a tool has already executed, its result is withheld from Claude, creating a closed-failure model where uncertainty defaults to denial.

Key Takeaways

  • UserPromptSubmit hooks now block skill shell commands if the prompt is blocked.
  • updatedInput from hooks must be valid, complete, and free of unknown keys or the call is denied.
  • Cowork cloud sessions ignore setMode updates from PermissionRequest hooks.
  • Plugin hook failures now result in action refusal rather than pass-through.
  • Agent tool lists no longer support fuzzy prefix matching for MCP servers.

The Bottom Line

Anthropic is tightening the leash on automation, prioritizing predictability over flexibility. Developers relying on loose hook behaviors must audit their configurations immediately, as silent failures are no longer an option.