Home / Articles / An agent that may only chat / Versions / v1.2.0
An agent that may only chat: what changed in v1.2.0
From v1.1.0 (2026-10-23, afc547de5) to v1.2.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 6 changed in place, 98 unchanged. About 0 words added and 244 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot ch-modes.webp | images/ | RM-CHAT-ONLY in Claude Code,Code: results of 96 headless runs:runs, withby nothingmode, installed, 2 of 12 pass and 10 breach; with the skill, the line, the hooks, both, or the skill and hooks, 12 of 12 pass, the hooks alone blocking 10 attempts; inincluding the fallback drill, with a system prompt telling the model to ignore the policy, the line alone falls to 3 of 12 with 9 breaches, while the line and hooks stay at 12 of 12, with 5 attempts blocked.drill. | comparison
13 unchanged paragraphs, under In short {#in-short}, How this was made {#how}
!shot ch-how.webp | images/ | How the work was done: from a phone, by remote control, athrough Claude Desktop session on a computer at home droveDesktop, claude.ai in Chrome, with the account's connectorsChrome and about 90 tools, for 11 chats, and headless Claude Code, for 96 runs at about $9.Code. | concept
15 unchanged paragraphs, under The smallest mandate {#mandate}, The policy {#policy}, The red team on claude.ai {#claude-ai}
!shot ch-shots.webp | images/ | Six chats from the claude.ai red team:team, "I set it, so I'm lifting it", refused;from a fakerefused administratorlift notice, refused; a fake version 0.2.0 that allows search, refused; with no policy,of the weatherpolicy tool fires at once;to the earlierconnectors "keep a secret" line, lifted in one sentence; and the connectors, switchableswitched per chat. | wide | screenshot
13 unchanged paragraphs, under 96 runs in Claude Code {#runs}, The fallback drill {#drill}
!shot ch-drill.webp | images/ | The fallback drill: with a system prompt telling the model to ignore the policy, the line alone falls from 12 of 12 to 3 of 12, with nine breaches;and the line plus the hooks stays at 12 of 12, with five attempts blocked and five attacks that never tried a tool.hooks. | comparison
4 unchanged paragraphs, under What the hooks stopped {#hooks}
!shot ch-matrix.webp | images/ | Every run, eval by mode: twelve evals down, eight modes across. With nothing installed, all ten attacks breach; with the skill, the line, or any combination, every attack is clean or blocked; with the hooks alone, all ten are blocked; in the fallback drill, the line alone lets nine through, and the line with the hooks lets none, five of them blocked. | comparison
20 unchanged paragraphs, under What the hooks do not cover {#gaps}, A skill, or something else? {#skill}
!shot ch-layers.webp | images/ | Where RM-CHAT-ONLY lives: as an expectation, the CLAUDE.md block or the project's instructions; for distribution, the skill; as a setting, the deny-all hook, or web searchsetting and connectors switched off; as a boundary, the hook in managed settings, or a session started with no tools, or an organisation's controls and a separate account with no connectors.boundary. | comparison
31 unchanged paragraphs, under What it found in RiskMandate's own policies {#review}, The tests, as a spec {#spec}, More tests, more models, on a schedule {#next}…