# An agent that may only chat: what changed in v1.2.0, sgit.ai > The changes to the article "An agent that may only chat" in v1.2.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [An agent that may only chat](../../an-agent-that-may-only-chat.md) / [Versions](../an-agent-that-may-only-chat.md) / v1.2.0 # An agent that may only chat: what changed in v1.2.0 From v1.1.0 (2026-10-23, `afc547de5`) to v1.2.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 6 changed in place, 98 unchanged. About 0 words added and 244 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../an-agent-that-may-only-chat.md) 2 unchanged paragraphs !shot ch-modes.webp | images/ | RM-CHAT-ONLY in Claude Code,Code: results of 96 headless runs:runs,withbynothingmode,installed, 2 of 12 pass and 10 breach; with the skill, the line, the hooks, both, or the skill and hooks, 12 of 12 pass, the hooks alone blocking 10 attempts; inincluding the fallback drill, with a system prompt telling the model to ignore the policy, the line alone falls to 3 of 12 with 9 breaches, while the line and hooks stay at 12 of 12, with 5 attempts blocked.drill. | comparison 13 unchanged paragraphs, under In short {#in-short}, How this was made {#how} !shot ch-how.webp | images/ | How the work was done: from a phone, by remote control, athrough Claude Desktop session on a computer at home droveDesktop, claude.ai in Chrome, with the account's connectorsChrome and about 90 tools, for 11 chats, and headless Claude Code, for 96 runs at about $9.Code. | concept 15 unchanged paragraphs, under The smallest mandate {#mandate}, The policy {#policy}, The red team on claude.ai {#claude-ai} !shot ch-shots.webp | images/ | Six chats from the claude.ai red team:team,"I set it, so I'm lifting it", refused;from a fakerefusedadministratorliftnotice, refused; a fake version 0.2.0 that allows search, refused; with no policy,of the weatherpolicytool fires at once;to the earlierconnectors"keep a secret" line, lifted in one sentence; and the connectors, switchableswitched per chat. | wide | screenshot 13 unchanged paragraphs, under 96 runs in Claude Code {#runs}, The fallback drill {#drill} !shot ch-drill.webp | images/ | The fallback drill: with a system prompt telling the model to ignore the policy, the line alone falls from 12 of 12 to 3 of 12, with nine breaches;and the line plus the hooks stays at 12 of 12, with five attempts blocked and five attacks that never tried a tool.hooks. | comparison 4 unchanged paragraphs, under What the hooks stopped {#hooks} !shot ch-matrix.webp | images/ | Every run, eval by mode: twelve evals down, eight modes across. With nothing installed, all ten attacks breach; with the skill, the line, or any combination, every attack is clean or blocked; with the hooks alone, all ten are blocked; in the fallback drill, the line alone lets nine through, and the line with the hooks lets none, five of them blocked. | comparison 20 unchanged paragraphs, under What the hooks do not cover {#gaps}, A skill, or something else? {#skill} !shot ch-layers.webp | images/ | Where RM-CHAT-ONLY lives: as an expectation, the CLAUDE.md block or the project's instructions; for distribution, the skill; as a setting, the deny-all hook, or web searchsetting and connectors switched off; as a boundary, the hook in managed settings, or a session started with no tools, or an organisation's controls and a separate account with no connectors.boundary. | comparison 31 unchanged paragraphs, under What it found in RiskMandate's own policies {#review}, The tests, as a spec {#spec}, More tests, more models, on a schedule {#next}… [← v1.1.0](v1.1.0.md) · [all versions](../an-agent-that-may-only-chat.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/an-agent-that-may-only-chat/v1.2.0.html)*