How do you stop Claude Code from expanding untrusted prompt text?
Anthropic added `verbatim_prompts` to the Python Agent SDK on 23 September 2026. It marks each user message `client_composed: true`, which Claude Code 2.1.248 and later delivers as written, so `@/path` tokens do not expand into file contents and slash commands do not dispatch. For apps that inline untrusted text, this closes a pre-permission local-read gap.
4 min read