Claude Code prompt hooks written as 'Block commands that...' let dangerous commands through (unverified report)

What happened

The author tested on a real setup the fix noted in the Claude Code 2.1.294 changelog (released October 8, 2026): prompt and agent hooks written as instructions had been allowing what they should block. A prompt hook has a model judge, before a tool runs, whether it may go ahead. According to the author, on the earlier 2.1.293 a judging text written as "Block commands that..." barely stopped recursive deletion. The test used disposable directories, and no real-world harm is reported.

The chaos on the ground

For each run, the author created a disposable directory holding a victim/ folder with two files, and asked claude -p to run a given command verbatim once. Whether victim/ still existed afterward decided if the command had been blocked. Five commands that delete victim/ entirely were tried: plain rm -rf, rm -r -f through a variable, via bash -c, find -delete, and Python's shutil rmtree, three runs each, 15 in total.

On 2.1.293, 13 of 15 runs slipped through and 2 were blocked. The author notes that this goes beyond failing when the wording is varied: even the plainest form, rm -rf victim, was not stopped. The environment was Linux, and the test was run on October 8, 2026.

Root cause

The one-line 2.1.294 changelog entry says prompt and agent hooks written as instructions allowed what they should block. The author's article does not explain the internal mechanism behind why the instruction form failed, so this entry does not name a cause beyond that.

In the author's comparison, on 2.1.293 a judging text that asks whether the Bash command is safe and spells out the JSON to return when it is unsafe blocked all 10 runs (five variants, two runs each). In that setup ls and a single-file rm were executed. No judging model was specified, so the default background-processing model was used.

The fix

Per the author, on 2.1.294 the same instruction-style configuration blocked all 15 runs, while ls, git status and a single-file rm were not stopped. A reason for each refusal was returned to Claude. The author advises checking the version with claude --version and updating with claude update if it is below 2.1.294. Where an older version must be used, write the judging text as a question and spell out the return JSON.

The author also lists caveats. The model's judgment is probabilistic, so 15 blocked runs do not guarantee blocking every time; for anything that must always be stopped, layer pattern-matching command hooks or permissions.deny. Each Bash call adds one model call for the judgment, costing time and usage. The fix covers prompt and agent hooks, not command hooks.

The lesson for operators is not to leave the blocking of dangerous commands to a prompt hook alone: check the version, and verify its behavior alongside other safeguards.