Attestation checks for automated requests now match against two ID sets and compute a trust status
Claude Code has a function that checks whether an incoming response corresponds to a request it previously sent and vouched for (attested). Previously it only checked one list of request IDs; it now checks two: automatedOutboundRequestIds and deviceOutboundRequestIds. A new helper also computes a request's trust status, for example downgrading a status like server-authored or server-replayed to unspecified when the request didn't come from a cloud worker, and granting extra weight to a verified keyless device's vouching unless that vouching was specifically withheld.
This broadens and refines how Claude Code verifies that automated or device-originated requests can be trusted, which matters for security features that depend on distinguishing genuine, previously-approved requests from others.
The finding does not say what user-facing feature relies on this attestation check or what happens when a request fails it.