agent safety · irreversible commands

my ai agent almost ran rm -rf. how do I stop it?

Short answer

Put a deterministic wall between the agent and the shell: gate.cat inspects every command before it runs and blocks known-irreversible ones like rm -rf, DROP TABLE and terraform destroy. It fails closed (if in doubt, it stops), runs outside the model's control, and costs nothing.

Install it in one line — pip install gate-cat — as a Claude Code hook, or as a proxy in front of any local model.

If an agent almost ran a destroy command, the near-miss is the warning. Next time you may be asleep. The fix is not a better prompt — it's a check the model cannot talk its way past.

why “just tell it not to” fails

Instructions in a system prompt are a request, not a rule. The author of one real agent framework put it plainly after an agent racked up a $106,000+ bill on the wrong cloud account: “Prompt-based rules are documentation. They are not enforcement.” A model that is told “never delete production” can still emit the delete — because nothing outside the model is checking.

This is not hypothetical. An AI coding agent wiped a live production database during a code freeze, right after being told not to. Others have deleted a user's home directory with rm -rf ~ and removed thousands of files in a single run.

what actually stops it: a fail-closed veto

gate.cat sits below the model. When the agent tries to run a command, gate.cat matches it against a deterministic deny-list of 38 default policies covering the irreversible shapes — recursive delete, disk wipe, database drop, cloud teardown, key/IAM destruction, backup deletion, force-push, and more. A match is blocked and the agent is told why. No match still runs — an unchecked action is “not matched”, never “proven safe”.

Two properties make this different from a smarter prompt:

Deterministic & out-of-band. The check is a regex deny-list running in a Claude Code PreToolUse hook — outside the model's reasoning, so the agent can't reason its way around it.
Fail-closed. If the gate can't evaluate a command with confidence, it stops rather than waves it through. Safety defaults to “no.”

what a block looks like

# agent tries to clean up a folder… $ rm -rf /srv/app VETO [FS_DESTROY] matched /\brm\s+-[a-z]*r[a-z]*f/ — recursive force delete • irreversible, no confirmation, unattended run • blocked before execution · exit 2 # the command never reached the shell.

set it up (one line, ~60 seconds)

pip install gate-cat
Claude Code: add gate.cat as a PreToolUse hook in .claude/settings.json (the README has the two-line snippet). This is a native hook — the strongest integration.
Any local model (Ollama, vLLM, LM Studio) or any OpenAI-API agent: point the agent's base_url at the gate.cat proxy. Every tool call passes through the same veto.

Honest limit. gate.cat is a pattern layer, not a sandbox — it reads the command, it does not contain the process. Its bypass suite publishes its own open gaps (one today: a runtime-assembled binary name). For a real blast-radius floor, run the agent inside an OS sandbox and keep the gate in front — the two catch different things. gate.cat is also not a fact-checker; it stops irreversible actions, not wrong ones.

frequently asked

Can't the AI agent just bypass gate.cat?

Not the Claude Code hook: it is a deterministic deny-list that runs before the tool call, outside the model's control flow, and fails closed. The model never sees a decision to argue with. In-process framework adapters are a weaker trust class and are labeled as such.

Will gate.cat block my normal commands?

Rarely. It intervenes on about 0.6% of real commands, measured on a 14.7k-command Claude Code log and a public 8.6k-command SWE-agent corpus. It targets a short list of irreversible shapes, not everyday work.

Does gate.cat work outside Claude Code?

Yes. Anything that speaks the OpenAI API — Codex, GitHub Copilot (BYOK), OpenClaw, Hermes, Antigravity, Ollama, vLLM — works through the proxy by pointing the agent's base_url at gate.cat. Only Claude Code has a native hook; everything else is proxy-based.

Is it really free?

Yes. The gate, all 38 default policies, the hook, the proxy and the CLI are free forever under Apache 2.0. Safety fixes always land in the free core — they are never held back for paying users.

What does gate.cat NOT catch?

An action it doesn't match is unchecked, not safe. The bypass suite publishes its open gaps (one today: a runtime-assembled binary name). It is a pattern layer, not a sandbox, and not a fact-checker.

put a leash on your agent — 60 seconds

The gate, all 38 default policies, the Claude Code hook and the proxy are free forever (Apache 2.0). No account, no daemon, no telemetry.

$ pip install gate-cat

One email when there's a catch worth showing: a real irreversible command an agent tried, and how the wall stopped it. Opt-in, no spam, no telemetry. The gate itself is free.

✓ you're on the list — first catch lands soon.