The hook that did not stop an AI agent's git operations

Summary

A hook that checks an AI agent’s git commands before they run was not stopping the commands called from the execution environment. This hook belongs to a service developed at my own company, and it read the command from an environment variable. The AI agent’s execution environment does not set that environment variable, and passes the input as JSON on standard input. Because of this, the hook let every command through with exit code 0. The message of the fix commit also says that it let every command through.

The hook was found not to be working only after an incident in which a branch got switched. The message of the commit that introduced the hook says that seven cases tested by hand behaved as expected. However, there is no record of how the input was passed. The tests added in the fix commit start the real script and pass JSON on standard input.

A hook that lets commands through with exit code 0 when it cannot read its input gives no sign that it is broken until a command that should be stopped arrives. How the input was passed in the test at introduction can only be inferred. It is also possible that the execution environment at the time of introduction did set this environment variable. And even after the fix, the hook lets the command through when it cannot parse the JSON.

What you can take away

This article is for people who build mechanisms that stop an AI agent’s operations with hooks in the AI agent’s execution environment.

• Because the git operation hook read only an environment variable, it could not check the commands that the execution environment passed on standard input.
• It can be inferred that the manual test at introduction and the automated tests added in the fix passed the input in different ways.
• A hook that exits with code 0 and no output when it cannot read its input is not caught even by the setting that blocks the call when a hook fails.
• That violations did not recur was not evidence that the hook had stopped commands.

This article rests on three sources: the git history in two repositories, the official documentation and public changelog of the AI agent’s execution environment, and the body of an earlier article. The official documentation was checked on 2026-10-14 and 2026-10-28, and the changelog on 2026-10-14. The two repositories are the repository of a service developed at my own company and a personal repository that tracks changes to the memory files and rules.