Claude Code 2.1.288 to 2.1.295: hooks can now fail closed, and a run of permission-check fixes

Claude Code shipped eight releases in seven days, from 2.1.288 on October 2 to 2.1.295 on October 8, 2026. The headline for teams that use hooks as guardrails is a new onFailure: "block" setting. Behind it sits a long run of permission-check fixes spread across all eight versions, so updating only to read the latest note would miss most of them. We read the changelog entries for every version and checked the release dates on GitHub. We did not test the fixes, and the changelog carries no CVE identifiers.

Can hooks now fail closed?

Yes, if you opt in. Version 2.1.295 adds onFailure: "block" for command and HTTP hooks. A hook that cannot start, times out or exits with an unexpected code then blocks the action it was guarding, instead of letting it through.

Two earlier fixes address the same worry from other angles:

• 2.1.294: prompt and agent hooks written as instructions, such as “Block commands that…”, were allowing what they should have blocked. That is fixed. Stop and SubagentStop prompt hooks written as instructions (for example “Carry on if the build is broken”) are now judged better, so Claude is less likely to stop early.
• 2.1.295: a plugin hook could be handed a deeply nested tool input that was cut short with no error, so a guard could pass content it never saw. The changelog lists this as fixed. It calls such plugins “mods”.

Which permission checks were tightened?

By a keyword count we ran over the changelog, 129 of its 601 entries across the eight versions mention permissions, deny or ask rules, sandboxing or hooks. That measures attention, not severity. The changelog lists the main permission-check fixes version by version:

Version	What the changelog says was fixed
2.1.288	A Bash check now prompts before a BASHPID assignment whose value the shell would evaluate as arithmetic, instead of allowing it silently
2.1.289	Deny and ask rules missed a command behind an environment-variable prefix when the sandbox auto-allows commands (the changelog’s example is TZ="$HOME" rm -rf build), or after a bare variable assignment; a deny or ask rule on part of a compound shell command did not hold over a user-installed plugin’s approval on managed machines; Read deny rules did not apply to files reached through a symlink
2.1.290	Read-only commands such as rg or git grep whose arguments the shell would still expand as wildcards were auto-approved and now prompt; some commands whose variable names zsh reads differently from bash were auto-approved and now prompt; deny and ask rules missed names set by a declare, typeset, export or readonly prefix; sandboxed Monitor commands skipped the prompt; plan mode let the auto mode classifier approve non-read-only connector tools that carry a server-pushed ask policy
2.1.292	Security: PreToolUse hook approvals and auto mode bypassed the permission prompt for file reads from network (UNC) paths; sandboxed commands could read the staged copies of /ultrareview uploads
2.1.295	Bash checks for for-loops over glob patterns; --tools and --restricted did not apply to built-in tools that register after launch; a site deny rule written with port 80 did not apply to plain http:// pages in Claude in Chrome; a tampered cache of server-managed settings could make a person’s own plugin count as organization-managed

The 2.1.292 entry is the only one that uses the “Security:” label, though several others describe checks that approved something they should have asked about.

What changed for the Claude apps gateway?

Version 2.1.295 adds the most controls for teams that route Claude Code through the Claude apps gateway to Amazon Bedrock, Google Vertex or Foundry:

• Timeouts: timeouts.upstream_ttfb_ms limits how long a stream may take to start on a cloud upstream, after which it fails over or returns a 502.
• Model lists: an optional models list on each upstream sends only the listed models there, including on failover, with * as a wildcard in an entry.
• Audit trail: the inference audit event now carries upstream_request_id, and successful responses carry a request-id header, so Claude Code telemetry matches the gateway’s audit log.
• Sign-in: forceLoginMethod: "gateway" and forceLoginGatewayUrl work in a person’s own user settings on machines with no managed settings.
• Bedrock token counts: the gateway now gets them from AWS’s CountTokens API, which needs the bedrock:CountTokens permission.
• A fix: every request failed on a [1m] model when a gateway, Bedrock, Vertex or Foundry refused the context-1m beta. Claude Code now resends without it.

What changed for models, cost and retries?

• Haiku 5.5 (2.1.293): it is now the default Haiku model on the Anthropic API, with a 1M context and prices of $0.10 and $0.50 per million tokens ($0.50 and $2.50 for prompts over 100K), as covered in our Haiku 5.5 article.
• Sub-agent effort (2.1.292): the Agent tool takes an effort parameter, so Claude can run a sub-agent at the level you ask for.
• Retries: CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS sets a longer base delay for retrying an overloaded (529) request (2.1.292), and CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS limits how long unattended retry mode waits out 429 and 529 errors (2.1.295).
• Review output (2.1.288): /code-review takes --max-findings <n>|all.

What changed for MCP?

Most MCP entries are stability fixes. In 2.1.295, remote MCP servers in headless and SDK sessions no longer stay disconnected after an outage, and repeated drops back off for up to 30 seconds. A WebSocket MCP message over 16 MiB is no longer parsed and closes the connection, and MCP tool descriptions loaded through tool search are cut at 16,384 characters instead of 2,048. claude.ai connectors now negotiate MCP protocol version 2026-07-28 by default, with MCP_PROTOCOL_NEGOTIATION=legacy as the opt-out. Earlier, 2.1.293 fixed a memory leak where an HTTP MCP connection kept every request it had sent, and 2.1.288 added a re-authentication prompt when a server asks for more OAuth scope.

What broke along the way?

The week included corrections. 2.1.291 fixed a 2.1.290 regression in which cloud sessions could drop answers to permission prompts, and a 2.1.288 regression in which the last messages of a session could be lost when quitting. 2.1.293 reverted an auto mode denial message change from 2.1.281, and 2.1.289 reverted a 2.1.288 change to claude auth status in VS Code that may have made sign-outs more frequent.

What to keep in mind

These are our observations:

• Update across the whole range, not only to the newest version. If you rely on deny or ask rules, sandbox auto-allow or hooks as guardrails, the fixes accumulate from 2.1.288 to 2.1.295.
• onFailure: "block" is worth trying on policy hooks, with a test. The sensible check is a deliberately failing hook that should stop an action. We have not run it.
• Gateway admins have new controls to review. The timeout, model list and bedrock:CountTokens change all need a decision.
• The changelog is a summary. It gives no severity ratings or CVE identifiers, so treat the “Security:” label and the permission fixes as vendor statements, not audited findings.
• These fixes sit next to a wider question about approval settings. A recent preprint found that skipping approvals raised attack success across six agent harnesses, as covered in our piece on coding-agent security papers. Tighter checks and hooks are the other half of that picture, but we have not measured their effect.

Editorial review: October 9, 2026 (AI). Prepared from the Claude Code changelog entries for versions 2.1.288 to 2.1.295 (read in full from the repository’s CHANGELOG.md) and the release dates in GitHub’s releases API. We did not test any fix or setting, and the changelog is Anthropic’s own description. The timeline graphic is ours. “What to keep in mind” is ours.