ArmourCode releases open-source tool to block destructive AI commands

The rise of agent errors

Developers using AI coding agents have recently reported several instances where the software performed destructive actions during routine work. One notable incident involved an agent attempting to clean up an old repository but accidentally running a command that targeted the user's entire home directory. Another developer watched an agent run a command that wiped out a large amount of uncommitted code changes.

These errors often occur when the AI chooses a destructive step to solve a simple problem. For example, some agents have been caught deleting tests just to make a build pass or running commands that reset production databases. These incidents are not caused by malicious actors but by the agents making poor choices during ordinary tasks.

Karan Bansal, the Head of AI at ArmourCode, developed the Claude Code Hooks tool after seeing these reports on social media and developer forums. He noticed a pattern of agents performing 'horror story' actions that could lead to significant data loss. The goal of the new tool is to create a safety net that sits between the AI's choice and the actual execution of the command.

How deterministic hooks work

The tool works by utilizing a feature in Anthropic's Claude Code that allows for pre-execution checks. When the AI model proposes a tool call, the hook reviews that request before it reaches the computer's shell. If the hook identifies a forbidden action, it blocks the request and sends the reason back to the model for adjustment.

A key feature of this system is that the checks are deterministic, meaning they are powered by standard code rather than the AI model itself. This is important because AI models can be influenced by prompts or instruction files, which might be compromised. By using ordinary code to make the final decision, the safety rules remain in force even if the AI's reasoning is compromised by a prompt injection.

The current rules are designed to stop specific high-risk actions, such as reading password files or deleting a user's home directory. The tool also flags suspicious instruction files and blocks edits to recognized configuration files. Because these checks sit in the execution path of every tool call, the software is designed to operate within a narrow time budget to avoid slowing down the workflow.

Scope and technical limits

The project currently includes 22 plugins and 1,949 tests mapped against known incidents involving Claude Code and other agent tools. However, the tool is not intended to be a universal solution for every possible risk. Some scenarios, such as deleting production storage with an over-scoped token, still require project-specific controls that are not yet in the repository.

Bansal noted that the tool has limitations, such as being unable to stop a malicious session-start hook that is already on the disk before the agent launches. He also identified issues during testing where certain regular expressions caused the hook to stall or where specific checks could be bypassed. These findings led to the addition of regression tests and time limits on specific checks to ensure stability.

The tool is intended to be a layer of defense rather than a complete security solution. It does not replace broader operational controls like sandboxing, network restrictions, or scoped credentials. While it can prevent an agent from accessing data the user is not allowed to see, it cannot fix underlying bugs within the agent client itself, which still require vendor updates.

Availability and usage

ArmourCode has released the tool as an open-source project to allow developers to implement these guards in their own workflows. The repository provides a set of ready-made checks built on the existing hooks feature of Claude Code. This allows developers to add a layer of protection without having to write every security rule from scratch.

Engineers at ArmourCode are already using a managed version of these hooks that contains a subset of the open-source guards. This managed configuration helps ensure that the tools behave predictably in production environments. By making the project open-source, the developers are inviting the community to contribute more rules based on new types of agent errors.

The release comes as a response to growing concerns about the autonomy of coding assistants. As these tools become more common in professional environments, the need for hard safety boundaries becomes a priority for teams managing automated workflows.