Hooks can now steer subagents, MCP permission rules got stricter, and Git is being rebuilt for agents

A quiet window on news, a busy one in the harness. The real movement is in Claude Code’s hook and permission layer (2.1.299 and 2.1.300). Nothing on the Disruption Watch moved up a rung; one entry is new.

The top 3

1. Hooks can now steer individual workflow agents, not just approve or refuse them

In 2.1.300 the agent.spawn mod hook can rewrite a workflow agent’s prompt and model; before, it could only refuse. Agent hooks now honour their own model setting, and updatedInput from PreToolUse and PermissionRequest hooks is validated like Claude’s own input: unknown keys are dropped, and input the tool rejects denies the call. In 2.1.299, turn.start fires for subagent turns too (tell them apart with e.agentId), and UserPromptSubmit hooks run before a skill or command expands, so a blocking hook also stops embedded shell commands.

Why it matters: policy can now sit at the point where a subagent is created and decide which model and instructions it gets. “Cheap model for triage, big model for planning” becomes enforced in code instead of a line in CLAUDE.md. For client work, that’s a cost and safety control you can show, not just describe.

Source: Claude Code CHANGELOG, 2.1.299 and 2.1.300

2. An MCP permission rule you wrote may now match fewer servers than you think

2.1.299 changed MCP allow rules so mcp__a reaches only the server named a. A server named a__b now needs mcp__<server>__* with the full normalised name. It also fixed deny and ask rules that didn’t apply when the normalised server name contained a double underscore. Cloud sessions and Remote Control connectors now negotiate MCP protocol version 2026-07-28 by default (MCP_PROTOCOL_NEGOTIATION=legacy opts out).

Why it matters: under the old behaviour a deny rule could silently fail to apply to a server with a double underscore in its name. Re-read your permissions rules. And if a scheduled job’s MCP connector behaves differently this week, the new default protocol version is the first suspect.

Source: Claude Code CHANGELOG, 2.1.299

3. Git forges are being rebuilt for agent concurrency

Cursor’s Origin, an agent-oriented Git forge with pull requests, review, GitHub mirroring and cloud agents, has been in early beta for paid plans since August. A Towards AI piece reports GitLab reworking parts of its source-control architecture for many agents reading, cloning and retrying against one repo at once. Origin publishes no repository-size, concurrency or benchmark figures, and I found no independent test.

Why it matters: when ten agents work one repo, the bottleneck stops being the model and becomes branches, locks and review. The question to start asking is which of your workflows break at five parallel agents on one repo, before a client asks.

Sources: Towards AI, Flavio Copes on Cursor Origin

Signal radar

MCP gateways are growing access control

WATCH Medium confidence, unverified.

The self-hosted side is adding the same controls vendors are adding first-party: LiteLLM now scopes MCP server access per request through an x-mcp-servers header and can suppress prompts or resources per server (reported in the agents-radar digest; I didn’t read the PRs). Two independent projects adding per-request MCP scoping in one week is the start of a pattern. The product shape to watch for is an “MCP firewall”.

Source: agents-radar, AI Infrastructure Digest, 15 October

Gemini 4 Argon’s useful detail is the price, not the model

CONTEXT Medium confidence.

You’ve seen the launch. The extra angle: secondary sources say the $2 / $10 per million token introductory rate doubles to $4 / $20 after the promotion (end date unconfirmed), and that the “1M” figure is an output limit, not an input window. It runs against the “everything gets cheaper” story: a frontier price that is explicitly temporary. I couldn’t retrieve Google’s own post.

Sources: eesel.ai, VKTR

Research frontier

PreciseCoder: debugging beyond unit-test rewards

WATCH Horizon: 12 months. Institution not listed in my source.

arXiv 2610.18755. The paper argues that rewarding a model only when unit tests pass teaches shallow fixes: make the test green rather than fix the cause. Instead it guides debugging with structural analysis of the code and a trace of how the failure happens. I saw a summary, not the numbers.

Why it matters: if a fix is judged by whether the failure trace now makes sense, “the agent edits the test until it passes” gets harder to fall into. You can approximate it today: require your agent to state the root cause and cite the failing trace before it edits anything.

Beyond the Verdict: agentic code judging with verifiable feedback

WATCH Horizon: 12 months. Institution not listed in my source.

arXiv 2610.18760. The judge is an agent that runs tests and cites the results as evidence, rather than giving a one-word pass or fail. A sibling paper the same day (2610.18766) does the same for LLM-as-judge evaluation.

Why it matters: it replaces a judge’s opinion with a judge’s evidence. It would matter if code-review bots start attaching reproducible evidence to each comment. Two papers on one day pointing the same way is a mild signal, not proof.

Both summaries come from a digest listing; I couldn’t open the abstract pages this window. Treat them as pointers.

New capabilities to adopt

Audit MCP permission rules after the matching change

ACT NOW

Open your settings.json files, list every mcp__… rule, and test one deny rule per server. About 15 minutes.

Enforce model tiers with an agent.spawn hook

ACT NOW

Rewrite a workflow agent’s model and prompt at creation time, so “Haiku for triage” is code, not habit. Pair it with turn.start to log every subagent turn. About 45 minutes; this is the experiment below.

Routines keep their environment when edited

CONTEXT

2.1.299: routines keep their environment even if the original was deleted, and scheduled tasks no longer fire early or repeatedly when daylight saving ends. No action unless you run self-hosted environments.

Source: Claude Code CHANGELOG, 2.1.299 and 2.1.300

Disruption watch

One new entry; nothing moved up. The full board is on the Watch page.

• New: Source control and review built for many agents on one repo: enters at Watching. Evidence: Cursor Origin in beta, GitLab reportedly reworking for agent concurrency. No independent benchmarks. Note the point where your multi-agent runs on one repo start colliding, and what you do then.
• MCP and tool protocols: Repricing the work. Held; cloud default is now the 2026-07-28 spec.
• Ultra-cheap and open-weight models: Repricing the work. Held, with a counter-signal in Argon’s temporary price.
• Harness and plugin layer: Hitting the market. Held; spawn-time rewriting adds depth, not a rung.
• Everything else held. Design generation, app generation and autonomous QA had no dated news in this window.

Practice shifts

Put the policy at agent creation, not in the prompt

ACT NOW

Take the “use the cheap model for search” line out of CLAUDE.md and put it in a hook that sets the model when the agent is spawned. A prompt rule is advice; a spawn hook is enforcement, and it leaves a log you can show. Keep CLAUDE.md for judgement calls.

Treat permission rule names as code that can drift

ACT NOW

MCP rule matching changed under existing configs. Add a small test that, for each MCP server you use, a deny rule really blocks one known tool. Run it after every Claude Code upgrade.

Plan for parallel agents on one repo

WATCH

Decide how many agents may touch one repository, who merges, and what the review queue looks like. The tooling around Git is being rebuilt for this, but nothing is proven yet.

This week’s experiment

Make your model-tier rule enforceable. 45–60 minutes.

Build: a Claude Code mod in a throwaway repo (scaffold it with the built-in plugin-authoring skill) with one agent.spawn hook. It logs agentId, model and the first 200 characters of the prompt to .claude/spawn-log.jsonl, and rewrites model to the Haiku alias for any workflow agent whose prompt starts with “search” or “triage”. Add a turn.start hook that appends the same agentId when subagent turns begin.

Done when:

1. A workflow with three agents produces three spawn-log rows, two of them rewritten to Haiku.
2. You’ve broken the hook on purpose (throw an error) and written down whether the spawn was refused or went through.
3. Your README has one line on what you’d need before trusting this on a client project.

---

Sourcing: the Claude Code changelog was read directly. Items marked unverified come from the agents-radar community digests rather than primary sources.