What
A tool that runs on a remote machine can now hand back attached documents alongside its text output, so Claude reads the PDF itself instead of a placeholder line. Only application/pdf is accepted, and each attachment must carry a timestamp, media type and base64 payload. The same tool also gained a message telling the user that an automatic approval does not count for it and that a person must approve from the terminal or the desktop prompt before it runs.
Details
- An attachment is converted only if its base64 data decodes to a
%PDF-header, it is under a size budget, and it matches a text placeholder in the result content. - Converted attachments become
{type: "document", source: {type: "base64", ...}}blocks in the tool result. - Oversized or malformed items are dropped individually, and the rest of the tool result still returns.
- A display fragment reading "(a PDF read on " ships alongside it for showing where the document came from.
- The approval notice reads that only a person's approval counts in this session, so it was not cleared to run and nothing ran.
Evidence
"application/pdf", only a person's approval counts in this session, so it was not cleared to run and nothing ran
Strings lifted out of the shipped bundle, so the claim above can be checked against them.