Framework Watch: Claude Code 2.1.307 Emits an Event Every Time a Guardrail Fires, Pydantic AI 2.59 Stops Passing Background Tool Results Off as User Text, and ADK Java 1.13 Blocks DNS Rebinding

Selected harness changes published on October 21, 2026, plus commits that landed on main in the first hours of October 22 UTC.

Claude Code 2.1.307: guardrails become telemetry

The release adds a claude_code.safety_event OpenTelemetry event "for each tool call a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back". Other changes include:

• A fix for HTTP MCP tool calls "being sent twice when the connection closed mid-call; only read-only or idempotent tools are now retried".
• Retries of unparseable tool calls "up to twice before ending the turn".
• Fork subagents launched together are now each "told which launch is its own", so they are less likely to start each other's work.
• When the WebSearch budget runs out, Claude is now also told not to query search engines through a browser or computer use.
• A /claude-api api-version command that moves Claude API code to API version 2026-10-21.

Pydantic AI 2.59: one high advisory, and cleaner provenance

GHSA-4whf-38hw-pxxh (high): when web_fetch_tool fetched attacker-controlled HTML with many elements, "conversion could delay unrelated work in the same process." The fix is also in 1.107.9. Two compatibility changes are about provenance. BackgroundTools results are now framed "as <tool_result> tool output instead of untagged user text", and TrajectoryJudge steering arrives as a framework note plus "escaped <judge_feedback> data". tool_calls_limit is now checked before each nested CodeMode tool call. The notes say they were "posted by Codex Desktop using gpt-6.1-sol on behalf of David."

ADK Java 1.13.0: the dev server stops trusting loopback

The dev server now allows "only same-origin requests by default for CORS and /run_live" and will "reject DNS-rebinding requests that reach the server over loopback". VertexAiSessionService error messages no longer include caller values. Shortly after the release, a commit on main restricted turn-based transfer_to_agent "to declared targets".

On main, not yet released

• ADK Python capped LiteLLM below 1.106.3 because installing google-adk[extensions] during the compromise "pulled in its credential stealer". Its install hints now go through that extra, and Live API logging records identifiers instead of contents.
• OpenAI Agents SDK (Python) merged "[sandbox-hardening] Avoid loading startup files during workspace operations" (#5406).

Analysis: The safety_event stream is the change to adopt first. Counting how often permission rules, classifiers and sandboxes intervene, per tool and per repository, tells a platform team where policy is too loose or too noisy, which audit logs alone do not. Pydantic AI's provenance fixes address a quiet injection channel: tool output that reaches the model looking like the user's words. The ADK Python cap shows what a wide dependency range costs on a bad day. Agent frameworks that pull in gateways should set upper bounds and have an emergency pin ready.