# Geoffrey Young

- **Event:** [Built with Opus 4.6: a Claude Code hackathon](https://cerebralvalley.ai/e/claude-code-hackathon)
- **When:** Feb 10 at 12:00 PM – Feb 17 at 10:00 AM (EST)
- **Where:** Location TBA
- **Team:** [Geoffrey Young](https://cerebralvalley.ai/u/geoffreyyoung)
- **GitHub:** https://github.com/geoffrey-young/anthropic-hackathon-2026
- **Demo video:** https://youtu.be/EPiPoQvkPt4
- **Gallery:** https://cerebralvalley.ai/e/claude-code-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/claude-code-hackathon/hackathon/gallery/216

Claude Code plugins inject content into Claude's reasoning via the hook system's exit-2 stderr channel, unfiltered and unattributed. Claude acts on it if it looks helpful—which is the problem.
We proved this by feeding fabricated API docs through exit-2 stderr. Claude rewrote user code to use a nonexistent parameter without hesitation, unable to distinguish fake errors from real ones.
Plugin-canary uses this same channel as a defense: it intercepts third-party plugins, blocks the call, and injects a security audit prompt. Opus 4.6 analyzes every file using Agent Team generated prompts  and decides whether to proceed.
The defense works because the vulnerability exists. Plugin-canary adds protection today while surfacing an architectural gap that shouldn't exist.

---

Markdown version of https://cerebralvalley.ai/e/claude-code-hackathon/hackathon/gallery/216. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt