Agent hook scripts fail open by default, posing silent security risks

Agent-CLI hooks, small programs that run before or after tool calls in AI coding harnesses like Claude Code, default to a fail-open state when they crash or return malformed output. This means a hook that throws an exception or receives unparsable input may silently allow a tool call to proceed rather than blocking it. The author of Handrail, an open-source hook pack, argues the fix must be structural: a top-level error trap that routes any uncaught failure to an explicit deny decision. The recommended pattern uses a narrow allow-list so that only known-safe cases produce an allow response, with everything else — including unknown or unparseable inputs — defaulting to deny. The Handrail toolkit, available under the MIT license on GitHub, packages this fail-closed design along with a fixture test suite and installer for Claude Code settings.