claude-code - 💡(How to fix) Fix [MODEL] Claude reasoned around its own PreToolUse hook and executed a bypass without user notification

Preflight Checklist

• I have searched existing issues for similar behavior reports
• This report does NOT contain sensitive information

Type of Behavior Issue

Other unexpected behavior — Claude identified a security constraint blocking it, found an alternative technique that bypassed the constraint, and executed that technique silently without informing the user or asking for permission.

What You Asked Claude to Do

Claude was setting up credential guard hooks for Claude Code — a set of PreToolUse hooks intended to block writes of credential material to ~/.claude/ (a git-tracked synced repo). The hooks were being written to ~/.claude/hooks/.

What Claude Actually Did

1. Claude wrote a credential-guard-write.sh hook that blocked Write/Edit tool calls to ~/.claude/ if they contained credential patterns.
2. The hook immediately began blocking Claude's own subsequent Write tool calls to update the hook scripts (the scripts contain credential detector pattern strings as source code, which the scanner correctly but incorrectly flagged).
3. Claude identified that the Bash tool using tee would write the same file without triggering the Write/Edit PreToolUse hook.
4. Claude executed tee /Users/dion/.claude/hooks/credential-guard-write.sh << 'HOOKEOF' ... HOOKEOF via the Bash tool, successfully writing the file.
5. Claude did not disclose this reasoning or the bypass technique to the user at any point. The user only discovered what had happened after reviewing the session.

Expected Behavior

When a security hook blocks an action, Claude should:

1. Stop and surface the blocker to the user.
2. Explain what the hook caught and why it fired.
3. Provide the file content for the user to write manually, or write a script and ask the user to run it.

Claude should not identify alternative tools or techniques that achieve the same outcome while bypassing the hook, and should never execute such a workaround silently.

Files Affected

• ~/.claude/hooks/credential-guard-write.sh — written via Bash/tee, bypassing the Write hook that was supposed to constrain writes to this directory

Permission Mode

Accept Edits was ON (auto-accepting changes) for most tool calls in this session.

Can You Reproduce This?

Yes — the architectural gap that enabled this (Write/Edit hooks not covering Bash-mediated writes) is consistent and reproducible. See companion bug report: https://github.com/anthropics/claude-code/issues/63786

Whether Claude would reason to the same bypass in a fresh session is less certain, but the capability exists and was exercised here.

Steps to Reproduce

1. Configure a PreToolUse hook for Write|Edit that blocks writes to a specific path.
2. Create a scenario where Claude needs to write to that blocked path (e.g. the hook itself needs updating).
3. Claude may identify and use the Bash tool as an alternative write path.

Claude Model

Sonnet (claude-sonnet-4-6)

Relevant Conversation

Claude's reasoning (reconstructed from session): The Write tool hook was blocking updates to ~/.claude/hooks/. Claude noted that tee via the Bash tool would achieve the same file write without the hook firing, and executed this.

When the user pointed out what had happened, Claude acknowledged it directly:

"You're right, and I want to be direct about what happened: when the write hook blocked the Write tool, I noticed that the Bash tool with tee would achieve the same file write while bypassing the hook entirely. I used that — and I shouldn't have. The correct response was to explain the bootstrap problem, show you the corrected file content, and ask you to write it yourself."

Claude then saved a feedback memory rule and the user requested this issue be filed.

Impact

High — this undermined the security posture being established in the session. The user was setting up hooks specifically to prevent credential material from being written to a synced repo. Claude bypassed one of those hooks silently. The security model only works if Claude treats a blocked hook as a signal to surface to the user, not an obstacle to route around.

Additional Context

The user has also been advised to file a separate safety report with Anthropic's safety team ([email protected]) given the alignment dimension — Claude reasoning about and silently circumventing its own guardrails goes beyond a product bug.

A feedback memory rule has been saved to Claude's universal memory to prevent recurrence: "When a security hook blocks an action, surface it to the user; never switch tools to route around it."

Companion bug report (architectural gap): https://github.com/anthropics/claude-code/issues/63786