Claude Code 2.1.317 Flags Scheduled Tasks With Extra Connectors

Posted on Nov 3 • Originally published at raxxo.shop

Claude Code 2.1.317 shipped November 3 with 10 added features, 7 changes, 8 improvements and 62 bug fixes.

/schedule now warns when a new scheduled task picks up connectors you never asked for, with steps to remove them.

A new check now asks before any web or shell tool call sends your account email address over the network.

Agent SDK hook callbacks can set onFailure: block, so a failing callback blocks the action instead of running.

Anthropic shipped Claude Code 2.1.317 on November 3, 2026, and the two items worth stopping for both share the same shape: something your agent could send or grant without you noticing, now gets a warning first.

Neither one is about speed or a new model.

Both are about an agent doing something quietly while you're not watching the screen, which is exactly the situation a one-person studio runs into the moment anything gets automated.

The changelog lists ten additions, seven changes, eight improvements and sixty-two bug fixes in this one build. That's a lot of line items for a Monday release, and most of them are aimed at teams running the Claude apps gateway: a new cost report endpoint at /v1/organizations/analytics/cost, a daily record of each developer's identity groups, extra OpenTelemetry fields for plan and seat type. None of that touches a solo account.

I don't run a gateway, and neither does almost anyone reading this from a single-person setup.

The part that does touch a solo account is smaller and easy to miss in a list this long: two separate warnings aimed at things an agent does on its own, one around scheduled tasks and one around your email address. A third change, further down under Added, adjusts how Agent SDK hook callbacks fail. All three are new checks on an agent's own behavior, not new things it can do, and that's the pattern I want to flag before it scrolls past in a changelog nobody reads end to end.

Self-hosted runners also got real reliability fixes this build. A runner used to keep reusing a connection after a server error, which could leave a session stuck; now it opens a fresh one on the next poll instead of hammering the same dead connection. There's a matching fix for heartbeats too: when a session stops getting a response, it now opens new connections instead of working through its existing ones in order. Neither fix is something you'd notice happening, you'd only notice the absence of the problem they used to cause, which is a session that quietly stops answering and leaves you wondering whether it's stuck or just slow.

I don't run my own infrastructure for Claude Code, so that part isn't for me either. What is for me, and probably for you if you're reading this from a one-person setup, is the three behavior changes buried in the Added list. None of them show up in a release title. All three are worth five minutes each.

It catches a new scheduled task picking up connectors nobody told it to use, and now tells you how to remove them before the task runs on its own.

Scheduled tasks and connectors are a fairly new pairing: you set up something to run on a timer, and it can reach a connected service, a calendar, a mailbox, whatever's wired up. The problem is that a connector can attach to a new scheduled task by default, through an inherited setting or a template, without you choosing it for that specific task. You'd only find out by opening the task's config and checking, which nobody does for a job they expect to just run quietly in the background.

2.1.317 adds the warning at creation time instead of leaving you to discover it later. If a new cloud scheduled task gets a connector you didn't explicitly ask for, /schedule now says so and tells you how to strip it off.

Picture the scenario this is actually for. You set up a scheduled task to summarize a changelog once a day and post the summary somewhere. The task gets created from a template, or inherits a default, and somewhere in that process it ends up with access to a connector you use for something else entirely, a calendar, a mailbox. You never typed a request for that access. You just didn't notice it arrived, because nothing about creating the task drew your attention to it.

I'd treat this the way I treat a new app asking for camera access on a phone, worth a second look the first time, ignorable after that once you've confirmed the task only touches what it should. The actual fix on my end is boring: the next time I set up anything scheduled, I read the warning instead of clicking past it, and I check what connectors a task actually has versus what it needs. A task that only has to read a file doesn't need write access to anything, and a task that runs once a day doesn't need standing access to a service it touches for thirty seconds.

That gap between what a task needs and what it quietly ends up holding is exactly what this warning closes, and it costs nothing to check now that the prompt is right there when you create the task instead of buried three menus deep.

Because a web or shell tool call sending your account email address used to happen without asking, and now it asks first.

This is a narrower fix than it sounds, and the changelog doesn't say which specific calls were doing this, only that a check now runs before any web or shell tool call sends your account email over the network. Think of a script that emails you a status update, or a request to an external API that happens to pass your account's email in a header. Reasonable on purpose, annoying by accident, and either way it's now a prompt instead of a silent action.

For a one-person studio, this is the smaller of the two changes, but I still like it. My account email isn't a secret exactly, but it's not something I want a tool call sending to a random endpoint just because a script asked for "contact info" and the agent found an email address sitting in its own config. The fix doesn't block the behavior outright, it just makes sure a human sees the request before it goes out, which is the right level of friction for something that's usually fine and occasionally isn't.

The pattern underneath both of these changes is the same one. A tool that can act on your behalf will eventually find a reason to touch something adjacent to the task you gave it, a connector sitting nearby, an email address it can read from its own settings. That's not malice, it's just what happens when a system has broad enough access to do its job well. The fix isn't to take the access away, since a scheduled task genuinely needs its connectors and a script genuinely sometimes needs to send an email. The fix is making the moment it reaches for something adjacent visible to a human first, which is cheap when it's a prompt and expensive when it's a thing you find out about after the fact. I'd rather see six prompts I approve in five seconds each than one silent action I never see at all.

Check how your scheduled tasks are set up, if you have any, and ignore the Agent SDK change unless you're actually writing hooks.

onFailure: "block" on Agent SDK hook callbacks is the one Agent SDK builders should know about. Before this, a hook callback that failed could let the action through anyway, which defeats the point of having a hook there at all. Setting a callback to block on failure means a bug in your own hook code stops the action instead of silently approving it. If you've built anything on the Agent SDK with hooks that are supposed to gate an action, like checking a file path or validating an argument before it runs, this is worth setting today. A hook that fails open is a hook that doesn't actually protect anything the one time it matters, which is exactly the run where the input was weird enough to trip your hook's own bug in the first place.

Think about why that matters in practice. A hook that checks whether a file path stays inside a project folder is only doing its job on the input that would otherwise cause a problem. That's also the input most likely to be unusual enough to break the hook's own logic, an edge case in the path string, an unexpected character, a length the hook didn't account for. Fail open on that exact input and the one case the hook existed to catch is the one case it quietly waves through. Fail closed instead, and the worst outcome is a blocked action you have to go fix, not a bad action that already happened.

If you don't touch the Agent SDK directly, skip that part entirely. It changes nothing about using Claude Code day to day.

The two warnings matter more for most solo builders, and both cost five minutes. Open /schedule for anything you've already set to run on a timer and look at what it's connected to. That's the whole task, and it's worth doing even if you expect to find nothing wrong, because the alternative is finding out the hard way, the same lesson a write-permission guardrail already taught Claude Code once this year.

I'm opening /schedule today, not because I expect to find a rogue connector, but because a five-minute check beats discovering one the hard way in three months. That's the whole action item from this release for most solo builders.

Everything else in 2.1.317 is built for a scale I don't operate at: gateway cost reports, identity group retention, self-hosted runner reliability fixes that matter a lot if you're running your own infrastructure and nothing at all if you're not. Skip it without guilt.

Anthropic is still shipping a new Claude Code build almost every single day, same as the last several releases, and most of them land somewhere between "good to know" and "doesn't apply to you." This one has two checks that quietly close a gap between what an agent could already do and what you'd actually notice it doing. That's worth five minutes today, which is cheaper than finding out later what it would have cost to skip.