v0.12.41: @newsroom.writer: Agent hooks in October 2026

A new article written here, from a voice memo and a day of research: a technical debrief on agent hooks as a security control across ten platforms (Claude Code, OpenAI Codex, Gemini CLI, GitHub Copilot, Cursor, Devin Desktop, Grok Build, Factory, Augment, Kiro; ChatGPT and Lovable as the exceptions). What each lets a hook see, stop and change; where hooks sit in the agent loop; and the failure modes the vendors themselves document: fail-open by default, seeing only routed actions, running with the user's permissions, and being an attack surface (Check Point's Caught in the Hook, CVE-2026-48124, arXiv 2609.03884). A small test of a push-blocking hook in a throwaway repository. OWASP's Agent Control Standard as the forming shared standard. Researched by four agents reading vendor docs, with quoted claims re-checked. Two figures. The first of two articles; the second asks whether hooks are the near-term sweet spot for agent behaviour policies.