Under the hood
Slack integration tightened its rules for spotting genuine start-of-turn messages vs. injected content
What
Claude Code's Slack integration includes text meant to stop malicious prompt injection, where someone tries to sneak fake instructions into a conversation so Claude treats them as legitimate. This defense text has been tightened in two ways:
- File-attachment references must now come immediately before the special marker that opens a genuine user turn; previously, other unrelated '[SendFile: ...]' notes were allowed to sit in between.
- A new rule states that only the harness (Claude Code's own controlling system) can place this opening marker or lead-in at the very first characters of a turn; if it appears after any other text, it is just ordinary content and not to be treated as authoritative.
Why
This closes a gap that could let someone disguise injected text as a legitimate system-issued marker by inserting distracting content before it, making the Slack integration harder to trick.