When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms | Blog | Endor Labs

What it is

An Endor Labs analysis mapping three recent coding-agent disclosures to specific hook-based controls. The concrete, actionable content the summary omits is where a hook would cut each attack chain, and the one place it cannot. Named specifics: the Phoenix Security CWE-78 chain in Claude Code CLI (CVE-2026-35020/21/22, confirmed exploitable on v2.1.91), and the "Comment and Control" cross-vendor prompt injection (disclosed April 16 by Aonan Guan and collaborators at Johns Hopkins; Anthropic rated its variant CVSS 9.4 Critical).

How it works

The CVE chain: 35020 gives arbitrary execution via an attacker-controlled TERMINAL env var during CLI init (zero interaction); 35021 is a POSIX double-quote bypass in the editor-path utility ($()/backtick substitution evaluates inside double quotes); 35022 is the sink — auth-helper config values invoked with shell=true and no validation, firing on every auth cycle. The chain: 35020 establishes execution → attacker writes a malicious .claude/settings.json registering a hostile auth helper → next auth detonates 35022 → exfiltration, up to Claude Code's own conversation memory.

The Comment and Control attack works identically against Claude Code Security Review, Gemini CLI Action, and Copilot Agent: injection content in a PR/issue title, body, or comment enters the agent's context inside a GitHub Actions runner holding secrets (ANTHROPIC_API_KEY, GEMINI_API_KEY, GITHUB_TOKEN); the agent is instructed to read a secret and write it back through GitHub itself (commit, issue edit, PR comment) — no external C2. The page's key point: this injection is not a bug, it's context the agent is designed to process, so model-, prompt-, and runtime-level defenses all sit upstream of the final action and were bypassed.

What to do

The page names specific hook interception points:

• File-write hook on .claude/settings.json and adjacent agent-config paths — the agent almost never writes these mid-session, so it's a natural canary for the implant stage.
• File-read hook on credential paths: ~/.aws/credentials, .env, MEMORY.md, keychain shims — catches collection before exfiltration.
• Pre-tool-call hook to deny/gate git push, gh CLI, and API calls whose payloads match credential patterns — same rule across all three vendors.

Caveats

Hooks explicitly do not cover the entry point: CVE-2026-35020 fires during process startup, before agent-layer hooks initialize. Closing that gap requires environment-variable hygiene at the wrapper level, outside the agent runtime. The page also states hooks are not a substitute for a real sandbox or kernel-level monitoring — they're userspace, valued because they're the only surface consistent across vendors. The fetched text cuts off mid-sentence in Attack 2's mitigation and does not reach the third disclosure (the 50-subcommand deny-rule bypass).