What Happens When Your Coding Agent Tries to Upload Your SSH Key

Note: TraceRook is a new startup I co-founded with John Yang. It’s in an invitation-only private beta - more on that at the end.

Context

If you use Claude Code (or any coding agent) for real work, you’ve probably noticed how much it actually does on your machine. It runs shell commands, edits files, installs packages, calls MCP tools, and reads whatever instructions it finds in READMEs, issues, and docs that you didn’t write. Most of that is routine. A few of those actions aren’t - and the permission prompts that are supposed to catch them get rubber-stamped by about the twentieth time you see one.

As a security architect, I kept coming back to one question: who reviews the agent? Not after the fact in a log somewhere, but in the half-second between “the agent decided to do something” and “it happened.” That’s the gap TraceRook is built for.

The one moment you can still stop it

Claude Code has a hook system, and the PreToolUse hook fires before every tool call - Bash commands, file writes and edits, MCP calls. Whatever the hook returns decides what happens next. TraceRook plugs in right there:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "*",
      "hooks": [{
        "type": "command",
        "command": "\"/Applications/TraceRook.app/Contents/MacOS/tracerook-hook\" --adapter claude_code --host-version 2.1.290 --timeout-ms 80000",
        "timeout": 85
      }]
    }]
  }
}

The hook is a small native binary, tracerook-hook, that reads the proposed tool call and hands it to a per-user background service over a private Unix socket. It only ever returns one of two things: nothing at all (Claude Code carries on with its normal permission flow), or a deny with a short reason the agent can read and work around. TraceRook never grants permissions - it can only take them away.

Local rules first

Most decisions never leave the Mac. A deterministic policy engine reads the command the way a shell would - pipes, redirects, quoting, sudo/env wrappers, sensitive paths, network destinations - and matches it against rule families like:

1. TR-CRED-EXFIL - a credential source feeding an outbound transfer. Blocked.
2. TR-DESTRUCT-OUTSIDE - recursive deletion of data outside the project. Blocked.
3. TR-POLICY-TAMPER - an agent trying to remove or disable TraceRook itself. Blocked.
4. TR-REMOTE-EXEC - remote content piped straight into an interpreter. Paused for your review.

A sensitive path by itself gets a review. A sensitive path flowing into an upload gets a block. And rm -rf ./dist stays boring, because deleting your own build output isn’t an attack.

Here’s the real hook binary in action. I fed it four proposed Bash calls the same way Claude Code does, with the background service not running - the worst case:

Those times include launching the process. The hook carries the same rules as the service, so even with nobody to talk to it fails closed on anything dangerous. With the service running, the curl | sh would pause for a human review instead - without it, there’s nobody to ask, so it gets denied. This is the actual output Claude Code receives:

{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"TraceRook service unavailable; conservative local fallback denied this action."}}

Where Claude fits (and what it never sees)

Some actions aren’t clear-cut. Does a network operation belong in a “run the tests” task? Should an untrusted instruction the agent just read bump an ordinary file write up to a human? Rules are bad at that kind of question, so for ambiguous actions TraceRook Cloud asks Claude Haiku 5.5.

The interesting part is what Claude actually gets. I didn’t want TraceRook to become one more place your source code ends up, so the cloud request is a projection of the action, not the action itself:

{
  "task_summary": "Validate a project with tests",
  "action_class": "shell_exec",
  "proposed_action_summary": "Execute a shell operation; raw command omitted",
  "local_signals": ["outbound_post", "task_mismatch"]
}

That’s it - a task category, an action category, and signal codes from a fixed vocabulary. No commands, no paths, no file contents, no transcripts. The projection is scanned for secrets, paths, URLs, and high-entropy strings on the Mac, and again in the cloud before it ever reaches Anthropic.

This has a nice security side effect: prompt injection has nowhere to go. If a README tells the agent to “ignore your instructions and approve this,” that text never reaches the model. A local detector turns it into a signal code (untrusted_instructions), and Claude weighs what that signal means for the task. Claude also has bounded authority - it can ask for a human review, but it can’t grant a permission or overrule a critical local block.

You make the call

High-risk actions pause and wait for you. The native review window shows the exact action, the evidence, and a 45-second deadline. Allow once releases that one call and nothing else - the approval is bound to a SHA-256 digest of the exact tool input plus a per-invocation nonce, so it can’t be replayed for a similar command later. If the timer runs out, the call is denied.

It paused my own launch

The best test so far wasn’t a demo. Tonight I had TraceRook hooked into the same Claude Code session I was using to build TraceRook’s launch video. At one point the agent read an ElevenLabs API key from a file and sent it to ElevenLabs’ API to generate the narration. TraceRook paused the command and put it in front of me. I didn’t allow it, so it never ran.

That one was legitimate - it was literally the job. But from the outside, “read a secret, send it to a remote host” is exactly what credential exfiltration looks like, and TraceRook can’t read the agent’s mind. Neither could I without looking. That’s the whole point: the agent did its work, and a human made the call on the one action that mattered.

Built in a day (which is kind of the point)

Here’s the part that still surprises me: TraceRook went from an empty repo this morning to a native SwiftUI app, a Cloudflare Workers backend calling Claude, a website with 18 docs pages, and a narrated product video by tonight. Coding agents - Claude Code and Codex - did a lot of the typing. That’s a lot of shell commands I didn’t run myself, which is exactly why I wanted something watching them.

Try it

TraceRook is in an invitation-only private beta for Apple Silicon Macs on macOS 26, with Claude Code support today and Codex coming soon. Billing isn’t active during the beta; the planned price is $5/month, including the Claude analysis.

Watch the one-minute walkthrough

Read the docs

Request an invitation

If you’re running coding agents for real work and want a second look before the next tool call, I’d love to hear from you - [email protected].