Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block

Anthropic shipped four Claude Code releases between October 6 and October 8, 2026, and the fix that matters most is in 2.1.294. Hooks of the prompt and agent types, when written as an instruction such as “Block commands that…”, could allow exactly the actions they were supposed to block. Version 2.1.295 arrived the same day with an option that turns a failing hook into a refusal instead of a pass.

What went wrong with prompt hooks

Hooks are checks you define yourself, which Claude Code runs at fixed points, for example before a tool call. Most are shell commands or HTTP endpoints. A prompt hook instead sends its text to a Claude model for a single-turn evaluation, and the model returns its decision as JSON. An agent hook, still marked experimental, starts a subagent that can use tools like Read, Grep, and Glob before deciding.

Version 2.1.294 fixes prompt and agent hooks whose text was phrased as an instruction, such as one beginning “Block commands that”. Those hooks allowed what they should have blocked. The release notes do not say which version introduced the problem. The same release improves how such hooks are judged on the Stop and SubagentStop events, so Claude is less likely to stop early.

A failing hook can now block

Version 2.1.295 adds onFailure: "block" for command and HTTP hooks. With it, a hook that cannot start, times out, or exits with an unexpected code blocks the action instead of letting it through.

The same release fixes the --tools and --restricted options, which did not apply to built-in tools that register after launch. It also fixes Claude in Chrome, which did not apply a site deny rule written with port 80 (host:80) to plain http:// pages on that host.

Earlier fixes in the same week

Version 2.1.292, released on October 6, 2026, and version 2.1.293, released on October 7, 2026, carried several more permission and sandbox fixes.

• In 2.1.292, flagged as a security fix: approvals from a PreToolUse hook and auto mode could skip the permission prompt for file reads from network paths in the Windows UNC format.
• In 2.1.292: sandboxed commands could read the staged copies of files uploaded for /ultrareview under ~/.claude/seed-admin.
• In 2.1.292: subagents defined with permissionMode: auto entered auto mode even when it was unavailable, for example because settings disabled it.
• In 2.1.293: the claude agents command offered bypass permissions that background sessions then ignored when consent was saved only in .claude/settings.local.json or a --settings file. It now asks for consent first.
• In 2.1.293, on Windows: stopping a status line, hook, or shell command could terminate an unrelated process that had been given the same process ID.