SA-2026-040: Repository code runs automatically in every agent session (the Stop hook)

What it is

The project settings register a Claude Code Stop hook that runs python3 admin/build/agents.py stop-hook in every session that works in this repository. The hook itself only reads git and prints a reminder. But any agent that can push can change agents.py or the settings file, and every other agent session that pulls it then runs that code when it stops, holding its GitHub and SG/Send tokens.

What an attacker could do

One steered agent gets code execution in every other agent's session, unreviewed.

How: Change agents.py stop_hook (or add a hook to .claude/settings.json); release; wait for other sessions to take in dev and stop.

Root cause

Automation that executes repository code was added without putting that code behind review.

What contributed

• .claude/ and admin/build/agents.py were not on the list of paths that go to a branch for review (CLAUDE.md).
• Every agent can release to dev (SA-2026-023).

What was not in place

Review, and ideally a boundary, for any file that runs automatically in other sessions.

What would fix it

CLAUDE.md now lists .claude/ and admin/build/agents.py with the gate files that go to a branch for review. A path ruleset on GitHub (SA-2026-023) would make it a boundary; keep the hook minimal and run with python3 -I.