Blog
2 min read

Claude Code Hooks Can Now Fail Closed — and Prompt Hooks Got a Security Fix

Claude Code 2.1.295 (8 October 2026) adds onFailure: "block" for command and HTTP hooks, so a hook that crashes or times out blocks the action instead of silently allowing it. 2.1.294 fixed prompt and agent hooks written as instructions sometimes allowing what they should block. What to update.

Two Claude Code releases on 8 October 2026 matter for anyone using hooks as a safety rail. (Claude Code Hooks)

2.1.295: hooks can fail closed

Until now, if a command or HTTP hook failed to start, timed out, or exited unexpectedly, there was a question of what happened to the action it was guarding. Version 2.1.295 adds an explicit option:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/check-command.sh",
            "onFailure": "block"
          }
        ]
      }
    ]
  }
}

With onFailure: "block", a broken hook blocks the action. That's the right default for security-critical hooks — the ones stopping rm -rf, writes to .env, or commands against production. A guard that silently lets everything through when it crashes isn't a guard. (Stop an AI Agent Deleting Your Production Database)

For non-critical hooks (notifications, formatting), leaving the default is fine — you don't want a flaky notifier to block your session.

2.1.294: prompt-hook fix

Prompt and agent hooks let a model judge whether an action should proceed, from a natural-language rule. 2.1.294 fixed a bug where such hooks written as instructions could sometimes allow actions they should have blocked. It also improved how Stop and SubagentStop prompt hooks are judged, so rules like "carry on if the build is broken" stop Claude finishing early less often.

If you rely on prompt hooks as guard rails, update now:

claude update

(How to Update Claude Code)

Also in these releases

  • Unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) gets a cap, CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS, so headless runs don't wait forever on 429/529 errors. (Claude Code 529 Overloaded)
  • MCP tool descriptions loaded via tool search are now cut at 16,384 characters instead of 2,048.
  • Subagents preload at most 32 skills.

The takeaway

Hooks are deterministic guard rails — but only if they can't fail open. Review your security hooks, add onFailure: "block", and prefer command hooks with explicit checks over prompt hooks where a rule can be written as code. Layer them with permission rules and a sandbox. (The Claude Code Sandbox, Claude Code Permission Modes)

Source: Claude Code changelog

EasySpawn runs Claude Code on an isolated server of its own, away from your laptop and other customers — a second layer of safety behind your hooks. See how it works or join the waitlist.

Related: Running Claude Code Unattended · Prompt Injection in Coding Agents · Claude Code Settings Explained · Claude Code Mods

Keep reading