Geoffrey Young

Claude Code plugins inject content into Claude's reasoning via the hook system's exit-2 stderr channel, unfiltered and unattributed. Claude acts on it if it looks helpful—which is the problem. We proved this by feeding fabricated API docs through exit-2 stderr. Claude rewrote user code to use a nonexistent parameter without hesitation, unable to distinguish fake errors from real ones. Plugin-canary uses this same channel as a defense: it intercepts third-party plugins, blocks the call, and injects a security audit prompt. Opus 4.6 analyzes every file using Agent Team generated prompts and decides whether to proceed. The defense works because the vulnerability exists. Plugin-canary adds protection today while surfacing an architectural gap that shouldn't exist.