agent-security

A guard hook that crashes or times out lets the dangerous command through in most coding agents. Fail closed for pre-action guards, fail open for everything else, and make the script fail closed by itself because Copilot, Codex and Gemini CLI treat a timeout as allow. Compared on Claude Code 2.1.295+, Cursor hooks, Copilot CLI 1.0.105, Codex and Gemini CLI, with a portable guard script.

A plugin hook fails with "Failed to run: Plugin directory does not exist" when the directory your session loaded the plugin from is gone: an update past the 14-day orphan window, a claude.ai sync that moved the folder to .trash, or a --plugin-dir you moved. Run /reload-plugins, read its summary line, and know which cases need a restart. Checked against Claude Code 2.1.310.

On container protocol 2.0.0, Foundry hosted agents isolate conversations and sessions per Entra caller by default. When your own backend fronts many end users, you delegate with x-ms-user-identity, grant a custom impersonation role, and key everything your container stores by session ID plus user ID. Here is the C# for each layer and the traps that leak data between users.

Since Claude Code v2.1.295, a command or HTTP hook can set onFailure to "block" so a guard that crashes, times out, cannot start or prints invalid JSON stops the tool call instead of waving it through. Here is the config, what counts as a failure, the events where it does nothing, and the exit-0 trap no setting can catch.

By default a local Cursor SDK agent runs every tool call without asking. Set local.autoReview to route Shell, MCP, and Fetch calls through the classifier, then steer it with the autoRun block in permissions.json. With code, the three-step evaluation order, and why none of it is a security boundary.