Claude Agent SDK: Lock Down Tools With Permission Hooks

An open-source agent runner crossed the line from neat demo to liability this month. After it surged past a million installs, security researchers started posting the same two failures over and over: the agent read files it was never meant to touch, and it spawned helper agents in a loop until the machine fell over. Permission leakage and uncontrolled agent spawning are now the two phrases every team shipping agents is searching for.

If you build on the Claude Agent SDK, you do not have to invent a guardrail framework to avoid this. The SDK already ships a layered permission system: declarative allow/deny rules, permission modes, a can_use_tool callback for runtime decisions, and lifecycle hooks that fire before every tool call and whenever a subagent starts. Wire them up correctly and a misbehaving model simply cannot read your .env or fork fifty copies of itself.