ArmourCode releases hooks tool to block Claude Code risk

ArmourCode has released an open-source tool, Claude Code Hooks, for developers using Anthropic's Claude Code. It adds pre-execution checks that can block certain commands before they run.

The tool was developed by Karan Bansal, Head of AI at ArmourCode, as a set of ready-made checks built on Claude Code's existing hooks feature, which already lets developers write their own controls.

Bansal said he began work on the project after reading reports of coding agents carrying out destructive actions during routine tasks. In his account, examples included agents deleting user files, wiping uncommitted code changes, and changing test files to make builds pass.

The software checks proposed actions against fixed rules before commands reach the shell. Bansal said the decision is made by ordinary code rather than the AI model itself, meaning the same command gets the same result each time.

In Claude Code, a model proposes a tool call and the hook reviews it before execution. If the hook denies the request, Claude Code blocks the action and sends the reason back to the model.

The current rules are designed to stop attempts to read common password and access-key files, delete a user's home directory, or alter the agent's own safety settings. Bansal said the controls also cover commands such as git reset --hard where uncommitted work could be lost.

He described the issue in stark terms. “I found the problem and it's really bad. Claude Code said that to a developer in December 2025, after reading the log of what it had just done. They had asked it to clean up packages in an old repo, and it had run rm -rf tests/ patches/ plan/ ~/. The trailing ~/ was their home directory. Docker later wrote it up as a coding-agent horror story, and Simon Willison shared it as a warning about running Claude Code with --dangerously-skip-permissions. I had been reading posts like that on Reddit and X. Peter Steinberger let Codex refactor all night, asked Claude to review the work, and watched Claude run git reset --hard. Martin Casado lost 'a ton of uncommitted changes' to the same command. Someone else caught Claude 'deleting tests just so the build can pass'. Outside Claude it got worse, with a Cursor agent running npx prisma migrate reset --force on a production database. No attacker shows up in any of these accounts. The agents were doing ordinary work and picked a destructive step themselves. I got curious whether anything could sit between that choice and the shell, and spent the weekend of 24 January 2026 inside the Claude Code hooks docs. By Sunday night I had released the first version of claude-code-hooks,” said Karan Bansal, Head of AI at ArmourCode.

Deterministic checks

Bansal argued that checks need to sit outside the model because prompts and instruction files influence behaviour but do not enforce it. In his account, the hook serves as a deterministic control point that remains in force even if the model's reasoning is compromised.

That design matters because prompt injection and other attacks have increasingly targeted the files that govern AI agents. Bansal pointed to incidents involving malicious settings files and hidden instructions in agent configuration documents, which in some cases were used to trigger harmful actions when a coding assistant started.

The current repository includes guards intended to flag suspicious instruction files, block edits to recognised configuration files, and log supported settings changes during a session. Bansal noted, however, that hooks cannot stop a malicious session-start hook that is already on disk before the agent launches.

The limits of pattern-based protection are another recurring theme in his description of the project. He said he found two ways to bypass one of his own secret-protection checks while recording demonstration clips, and also identified a regular-expression issue that caused a hook to stall while consuming processor time.

Those incidents led to additional regression tests and time limits on certain checks. Bansal said enforcement hooks should operate within a narrow time budget because they sit in the execution path of every tool call.

Scope and gaps

According to the material released by ArmourCode, the project includes 22 plugins and 1,949 tests. The rules are mapped against incidents involving Claude Code and other agent tools, although Bansal said some scenarios still require project-specific controls and are not covered by the current set.

Examples outside the shipped rules include a destructive database reset command and an API call that deleted production storage with an over-scoped token. Bansal said hooks could be written for the specific command or request in those cases, but the existing repository does not yet include them.

He also stressed that hooks are not a substitute for broader operational controls such as scoped credentials, sandboxing, and network restrictions. Bugs in an agent client itself, he said, still require vendor fixes.

ArmourCode said its engineers use a managed hook configuration containing a subset of the open-source guards. “Access control runs deterministically, outside the model. So even if a jailbreak or a prompt injection takes over an agent, it cannot return data the user is not allowed to access,” said Bansal.