Everything so far has been advice the model can ignore. A hook is where the harness stops asking.

Hook

Also called Agent hook, PreToolUse hook

A script the harness runs at a set moment, such as just before a tool runs or when the agent tries to stop. It can block the action. The model has no say in whether it runs.

A line in AGENTS.md saying "never run rm -rf" can be ignored. A hook that blocks it can't, as long as the hook recognises the command. A script looking for rm -rf will wave through rm -r -f, and in Claude Code, by default, the only exit code that blocks is 2.

Say it to your agent

“Add a PreToolUse hook on Bash in .claude/settings.json. It reads tool_input.command from stdin and exits 2, with the reason on stderr, if the command is rm with both -r and -f in any form. Test it on rm -rf, rm -r -f and rm -fr.”

Not to be confused with Git hook

A git hook belongs to git and fires on events like a commit. An agent hook belongs to the harness and fires on events like a tool call. You often want both.

Where you see it

All three tools have them (November 2026). Claude Code: PreToolUse in settings.json, where exit 2 blocks and by default any other non-zero exit lets the action proceed. Since v2.1.295 a command or http hook can set onFailure to block, so a crash, a timeout or an unexpected exit code blocks too. That setting has no effect on Stop hooks: exit 2 there sends the agent back to work, and a Stop hook that can't run doesn't hold it. Codex: hooks.json or config.toml, with the same event name and exit 2. Cursor: .cursor/hooks.json with preToolUse and beforeShellExecution, where exit 2 blocks and other failures fail open unless you set failClosed.

Hook

Before the agent

The agent

The harness

Everything it can get wrong

The operator

The workshop