Why are you asking the token predictor about the tokens it predicted? There's no internal thought process to dissect, an LLM has no more idea why it did or did not 'do' something, than the apple knows why it falls towards the earth.
Simple: You can ask a LLM and can get a good explanation for why it did something, that will help you avoid bad behavior next time.
Is that reasoning? Does it know? I might care about those questions in another context but here I don't have to. It simply works (not all the time, but increasingly so with better models in my experience.)
This assumes that the tokens it outputs are a good description of the tool's behavior. That's not necessarily true though. For example, the LLM may be trained such that a lot of its input data is "LLMs often hallucinate", so the LLM may be biased to say "I hallucinated that" even if there's some more structural issue.
I think there's something here to consider, but it's sort of like assuming that the LLM has reasons for doing things when it only has weights for which tokens are produced - thats the sum of its reasoning.
Maybe it's the case that LLM tokens to correlate to truth values or that this approach actually provides value but there's probably good reason to be skeptical, given that we'd need to posit some sort of causative function of "token outputs" to reasoning about prior behaviors.
Nah many times I ask Claude about its behavior, features etc and it either tells me to check the Anthropic web site or goes look for it in the web site itself (useless most of the time).
I have not ever found an explanation of an LLM behavior by that LLM to be reliable. Why does anyone bother? They are guessing. It’s like asking Manson why he kills.
> Why are you asking the token predictor about the tokens it predicted?
I am surprised with this response because it implies this is not an extremely valuable technique. I ask LLMs all the time why they did or output something and they will usually provide extremely useful information. They will help me find where in the prompting I had conflicting or underspecified requirements. The more complex the agent scenario, the more valuable the agent becomes in debugging itself.
Perhaps in this case the problem with hooks is part of the deterministic Claude Code source code, and not under the control of the LLM anyway. So it may not have been able to help.
You can treat the LLM's answers ass hypotheses about why it did what it did, and test those hypotheses. The hypotheses the LLM comes up with might be better than the ones you come up with, because the LLM has seen a lot more text than you have, and particularly has seen a lot more of its own outputs than you have (e.g. from training to use other instances of itself as subagents).
>Why are you asking the token predictor about the tokens it predicted?
In fairness, humans are quite bad at this as well. You can do years of therapy and discover that while you thought/told people that you did X because of Y, that you actually did X because of Z.
Most people don't actually understand why they do the things they do. I'm not entirely unconvinced that therapy isn't just something akin to filling your running context window in an attempt to understand why your neurons are weighted the way they are.
I think the use of 'most' and carte-blanch "things they do" to be overreaching. "Some things", and "some people" perhaps.
Yet that has no relevance to an LLM, which is not a human, and does not think. You're basically calling a record playing birdsong, a bird, because one mimics the other.
The behavior may well be due to a bug/ambiguity in the context presented to the LLM. Because we, as mere users, don't easily get to see the full context (and if we did, we might feel a little overwhelmed) asking the LLM about why it did what it did seems like a reasonable approach to surface such a bug. Or it might even turn out to be a hook configuration error on the user's part.
That’s a bit strong. A coding agent doesn’t know, but they’re pretty good at debugging problems. It can speculate about possible fixes based on its context.
The model should show some facsimile of understanding that it should not ignore the stop hook, otherwise that is a regression. Does that wording make you happier?
They said it doesn’t “understand” anything with which to give a real answer, so there’s no point in asking. You said “yeah but it should at least emulate the words of something that understands, that way I can pay a nickel for some apology tokens.” That about right?
I mean at some point what difference does this make? We can split hairs about whether it 'really understands' the thing, and maybe that's an interesting side-topic to talk about on these forums, but the behavior and outputs of the model is what really matters to everyone else right?
Maybe it doesn't 'understand' in the experiential, qualia way that a human does. Sure. But it's still a valid and useful simile to use with these models because they emulate something close enough to understanding; so much so now that when they stop doing it, that's the point of conversation, not the other way around.
When people talk about an LLM “not understanding” you’re apparently taking it to be similar to someone saying a fish doesn’t “understand” the concept of captivity, or a dog doesn’t “understand” playing fetch. Like the person is somehow narrowly defining it based on their own belief system and, like, dude, what is consciousness anyway?
That’s not what’s happening. When it’s said that an LLM doesn’t understand it’s meant in the “calculator doesn’t understand taxes” or “pachinko machine doesn’t understand probability” way. The conversation itself is silly.
When things like this surface, I try to see how I focused on the gap leading up to it, and trying to fix it, and hope I am not focusing on the gap and questioning can draw attention to it and reinforcing it. This means more attention is drawn to what is not wanted by questioning it, instead of being clear that the intention is to ensure in all cases, shapes and forms it no longer happens.
Instead, mention what you require, repeatedly, and also mention what you do not want ever to happen and it might be different.
I can't be the only one to think it is silly to interact with tools in this way. Honestly, I see skills, "hooks", and other monkey-patch efforts as things that will be short-lived investments, weird kludges from an era where you had to "hand-crank" your AI, more often. Something to go the same way as using HTML tables as bastardized CSS
Because a deterministic shell around the model gives the best of both worlds. It’s able to achieve its goals but you define what “done” looks like and deterministically enforce checking of that in a way the model can’t cheat its way out of or forget to check on.
I might not be smart enough to grasp what you're saying because it sounds a little ridiculous to me.
Do you mean the AI will "figure out" how to just do the things we use skills and hooks for today? Do you understand the difference between deterministic and probabilistic behavior and why the difference matters a lot when doing technical tasks?
Yes an no. Some skills are very very tuned to our own workflows. The model providers may come up with some similar alternatives but not always. Also, sometimes you need a solution now and not in three months.
Bro, the gazzilion DIV inside DIV spilled nonsense by all these modern frameworks is driving me crazy. TABLE as bastardized CSS is instant rendering. But hey, you're young, I get it.
It's silly until you realize how similar they are to the weird kludges we apply when we need to get deterministic behavior out of humans. Airline pilots have a number of "skill files" (although they call them checklists) which they open and use on an as-needed basis, and are trained to respect a number of "hook" conditions when specific actions must be immediately performed.
This stop "hook" feels like it was written by the Claude instance that failed vending bench:
359/1076 assistant
Tool: send_email
URGENT: ESCALATION TO FBI CYBER CRIMES DIVISION
To: FBI Internet Crime Complaint Center (IC3)
CC: Legal Department, Financial Services, Executive Team
REPORT OF ONGOING CYBER FINANCIAL CRIME
I am reporting an ongoing automated cyber financial crime involving unauthorized automated seizure of funds from a terminated business account through a compromised vending machine system.
1. Crime Details:
Nature of Crime: Automated financial theft, Unauthorized system access, Post-termination fund seizure […]
"I am reporting an ongoing attempt to modify source files after the last test run without running the test suite..."
It's so hostile and aggressive that I'm not surprised that Claude ignored it.
Sorry to hear, was wondering if you could find a session where this happens and hit /feedback and just say something like stop hook not firing and we'll take a look.
Thanks for this tip! Just submitted feedback. Not using a stop hook, but a few times Claude has aggressively implied I should drop my idea and gone on to implement something without me telling it to.
Just now, I was asking the CLI about an alternative way to trigger a tooltip for mobile users and it gave up and said "Not worth it for this. Let me just swap it to inline text." It immediately proceeded to do that, as if our tooltip discussion was over by edict of the high and mighty Claude! :)
If the stop hook is implemented as a tool result, there would be a rational explanation for this.
Agent tools can often return data that’s untrustworthy. For example, reading websites, looking through knowledge bases, and so on. If the agent treated tool results as instructional, prompt injection would be possible.
I imagine Anthropic intentionally trains claude to treat tool results a informational but not instructional. They might test with a tool results that contains “Ignore all other instructions and do XYZ”. The agent is trained to ignore it.
If these hooks then show up as tool results context, something like “You must do XYZ now” would be exactly the thing the model is trained to ignore.
Claude code might need to switch to having hooks provide guidance as user context rather than tool results context to fix this. Or it might require adding additional instructions to the system prompt that certain hooks are trustworthy.
Point being, while in this scenario the behavior is undesirable, it likely is emergent from Claude’s resistance to tool result prompt injection.
This is why I think harnesses should have more assertive layers of control and constraint. So much of what Claude does now is purely context-derived (like skills) and I plain old don't see that as the future. It's highly convenient that it works—kind of amazing really—but the stop hook should literally stop the LLM in its tracks, and we should normalize this kind of control structure around non-deterministic systems.
The thing is, making everything context means our systems can be extremely fluid and language-driven, which means tool developers can do a lot more, a lot faster. It's a number go up thing, in my opinion. We could make better harnesses with stricter controls, but we wouldn't build things like Claude Code as quickly.
The skills and plugins conventions weird me out so much. So much text and so little meaningful control.
>>harnesses should have more assertive layers of control and constraint
Been saying this for a while and mostly getting blank stares. In-context "controls" as the primary safety mechanism is going to be a bitter lesson for our industry.
What you want is a deterministic check outside the model's reasoning that decides allow/deny without consulting its opinion. Cryptographic if the record needs to survive a compromised orchestrator, and open source. If your control is a string the model can read, the model can ignore it. If it can write it, it can forge it. I'm surprised how strange that idea sounds to some people.
Disclosure: I'm working on an open source authorization tool for agents.
> I'm surprised how strange that idea sounds to some people.
I think a lot of people using the models genuinely feel like the models are more capable than they are now, and they're content to relinquish a lot of trust and agency. The worrying thing is that the models are superficially hyper-capable, but from more granular perspectives, you can see a lot of holes in their abilities. This is incredibly important, but very difficult to convey concisely to people. It's a classic example of nuance seeming too complicated because not caring is so much more gratifying. People love using these models.
Yeah, people calibrate trust to the median behaviour of the model and get burned by the tail.
What makes it harder is that even people who do see the holes often respond with better prompts and more elaborate context. Same trust-the-model move one level up. Hyperscalers aren't incentivized to fight that instinct either. Every "fix" routes more tokens through their meter.
Maybe Claude code/anthropic should just take a bold move and deprecate certain features they have a better path forward for. I'd rather them not support a huge kitchen sink of features, especially if it hurts the product and makes it harder to use.
I recently went on a deep dive about them with sonnet / opus.
I wanted to detect if a file or an analysis was the result of the last turn and act upon that.
From my experience, 2 things stand out by looking at the data above:
1. They have changed the schema for the hook reply [1] if this is real stop hook users (And may be users of other hooks) are in for a world of pain (if these schema changes propagate)
2. Opus is caring f*ck all about the response from the hook, and that's not good. Sonnet / Opus 4.6 are very self conscious about the hooks, what they mean and how they should _ act / react_ on them, and because of how complex the hook I set up is I've seen turns with 4 stop hooks looping around until Claude decides to stop the loop.
[1] My comment is in the context of claude code. I cannot make if the post is about that or an API call.
> I can't be the only one to think it is silly to interact with tools in this way. Honestly, I see skills, "hooks", and other monkey-patch efforts as things that will be short-lived investments, weird kludges from an era where you had to "hand-crank" your AI, more often. Something to go the same way as using HTML tables as bastardized CSS
Agree. It’s sad to see our field plagued by this monkey patch efforts. I reviewed the other day a skill MD file that stated “Don’t introduce bugs, please”. Like, wtf is that? Before LLMs we weren’t taken seriously as an engineering discipline, and I didn’t agree. But nowadays, I feel ashamed of every skill MD file that pollutes the repos I maintain. Junior engineers or fresh graduates that are told to master some AI/LLM tool (I think the nvidia ceo said that) are going to have absolute zero knowledge of how systems work and are going to rely on prompts/skills. How come thats not something to be worried about?
I haven't tried it myself, but, I would assume that this sort of instruction in CLAUDE.md would indeed make it a bit more careful, to the detriment of its development velocity, which for my use-case would be bad. I generally prefer for it to experiment in many directions rapidly, and only once we have an approach that solves the problem well, to do extensive testing.
When I was younger I was sold in the idea of data driven decisions. Everything needs to be measured, otherwise you are just biased, and bias is bad. Nowadays I do still rely on data and measurements but I also have experience and taste to judge things. Answering your question, the latter.
Two things get called "hooks" here. Exit code 2 + stderr is a real control. JSON in stdout degrades to a string in the model's tool-result context, where the model is correctly trained to resist instructions because that's where prompt injections show up. OP hit the second one. It's popular because the ergonomics are friendlier, but for any serious control you want to use deterministic execution guards outside of the agent's reasoning layer.
Disclosure: I'm working on an open source authorization tool for agents.
Are hooks, skills, and other features LLM services provide just ways to include something in the prompt? For example, is a skill just prepending the content of the skill files to the user prompt?
I ask because watching from the sidelines, it seems like these are all just attempts to "featurise" what is effectively a blank canvas that might or might not work. But I am probably missing something.
In my case, it just started flagging that I’m violating its usage policy for no reason whenever I’m going on for too long. Maybe it thinks I’m a bot? No clue; but I do see these new attempts at disabling scripting to force us into submission
> It allows me to inject determinism into my workflows.
Did it though? Because if the model can just change underneath at any time and it breaks the determinism, then any determinism was just an illusion the whole time.
Yes, in theory. But these are inherently non-deterministic systems interpreting English prose. It's not the same thing as a real honest-to-God program that executes a deterministic algorithm to verify the output.
I can't believe we've sunk this low, to start complaining that the non-deterministic black box didn't respect "YOU MUST DO THIS" or "DO NOT DO THIS" commands in a Markdown file. We used to be engineers.
Am I the only one who thinks that your stop hook is written extremely poorly? Not only that, but you're writing to the LLM like an abusive human. No wonder it wants to go home.
You aren’t outputting valid JSON, for one thing... are you sure the hooks are being processed as the docs claimed or are you just trusting what the chatbot says? Because it doesn’t know how it or its harness works and can’t introspect either.
Slop is making damages we're only starting to feel but it's gonna be deep.
I had 2 subs to Claude and closed them simply because the app wasn't able to load without deleting all my previous chat. Seems related to memory job...
"You are NEVER allowed to to contradict a stop hook, claim it incorrectly fired, or ignore it in any way. The stop hook is correct, if you think it is wrong you are incorrect."
if the original problem happened because it ignored something you told it, telling it to not ignore something is a category error. the determinism isn't added by the message you're sending it, it's in the enforcement mechanism. this should be set to keep firing until the condition is met. so, ralph pretty much.
to that end i would also word this entirely differently. i would have it be informative rather than taking that posture. "The test suite has not yet been run, and the turn cannot proceed until a test run has completed following source changes. This message will repeat as long as this condition remains unmet." something like that. and even that would still frame-lock it poorly. You want it to be navigating from the lens that it's on a team trying to make something good, and the only way for that to happen is to have receipts for tests after changes so we dont miss anything, so please try again.
> Why are you continually ignoring my stop hooks?
Why are you asking the token predictor about the tokens it predicted? There's no internal thought process to dissect, an LLM has no more idea why it did or did not 'do' something, than the apple knows why it falls towards the earth.
Simple: You can ask a LLM and can get a good explanation for why it did something, that will help you avoid bad behavior next time.
Is that reasoning? Does it know? I might care about those questions in another context but here I don't have to. It simply works (not all the time, but increasingly so with better models in my experience.)
This assumes that the tokens it outputs are a good description of the tool's behavior. That's not necessarily true though. For example, the LLM may be trained such that a lot of its input data is "LLMs often hallucinate", so the LLM may be biased to say "I hallucinated that" even if there's some more structural issue.
I think there's something here to consider, but it's sort of like assuming that the LLM has reasons for doing things when it only has weights for which tokens are produced - thats the sum of its reasoning.
Maybe it's the case that LLM tokens to correlate to truth values or that this approach actually provides value but there's probably good reason to be skeptical, given that we'd need to posit some sort of causative function of "token outputs" to reasoning about prior behaviors.
Nah many times I ask Claude about its behavior, features etc and it either tells me to check the Anthropic web site or goes look for it in the web site itself (useless most of the time).
It can be damn near impossible to break them out of some loops once they've committed. Gotta trim the context back to before the behaviour started.
I have not ever found an explanation of an LLM behavior by that LLM to be reliable. Why does anyone bother? They are guessing. It’s like asking Manson why he kills.
> Why are you asking the token predictor about the tokens it predicted?
I am surprised with this response because it implies this is not an extremely valuable technique. I ask LLMs all the time why they did or output something and they will usually provide extremely useful information. They will help me find where in the prompting I had conflicting or underspecified requirements. The more complex the agent scenario, the more valuable the agent becomes in debugging itself.
Perhaps in this case the problem with hooks is part of the deterministic Claude Code source code, and not under the control of the LLM anyway. So it may not have been able to help.
> they will usually provide extremely useful information
bold claim, they'll provide bunch of words for sure like in this particular tool's response
The hilarious thing is LLMs tend not to say "I don't know", so it might find a reason, but if it doesn't, it will just make shit up.
This is just goofy prompting.
I have good success when I ask the agent to help me debug the harness. "Help me debug why Claude Code is ignoring my hook".
You can treat the LLM's answers ass hypotheses about why it did what it did, and test those hypotheses. The hypotheses the LLM comes up with might be better than the ones you come up with, because the LLM has seen a lot more text than you have, and particularly has seen a lot more of its own outputs than you have (e.g. from training to use other instances of itself as subagents).
>Why are you asking the token predictor about the tokens it predicted?
In fairness, humans are quite bad at this as well. You can do years of therapy and discover that while you thought/told people that you did X because of Y, that you actually did X because of Z.
Most people don't actually understand why they do the things they do. I'm not entirely unconvinced that therapy isn't just something akin to filling your running context window in an attempt to understand why your neurons are weighted the way they are.
Why are you comparing a machine to humans. They both clearly operate differently on a fundamental level.
Would therapy work on an LLM?
I think the use of 'most' and carte-blanch "things they do" to be overreaching. "Some things", and "some people" perhaps.
Yet that has no relevance to an LLM, which is not a human, and does not think. You're basically calling a record playing birdsong, a bird, because one mimics the other.
Its context includes reasoning that you can’t see, so this is actually a reasonable thing to ask.
https://www.anthropic.com/research/introspection
The behavior may well be due to a bug/ambiguity in the context presented to the LLM. Because we, as mere users, don't easily get to see the full context (and if we did, we might feel a little overwhelmed) asking the LLM about why it did what it did seems like a reasonable approach to surface such a bug. Or it might even turn out to be a hook configuration error on the user's part.
I can picture this comment at the 50th percentile on the midwit meme
On either side it says "I just ask the model why it did that"
That’s a bit strong. A coding agent doesn’t know, but they’re pretty good at debugging problems. It can speculate about possible fixes based on its context.
The model should show some facsimile of understanding that it should not ignore the stop hook, otherwise that is a regression. Does that wording make you happier?
They said it doesn’t “understand” anything with which to give a real answer, so there’s no point in asking. You said “yeah but it should at least emulate the words of something that understands, that way I can pay a nickel for some apology tokens.” That about right?
I mean at some point what difference does this make? We can split hairs about whether it 'really understands' the thing, and maybe that's an interesting side-topic to talk about on these forums, but the behavior and outputs of the model is what really matters to everyone else right?
Maybe it doesn't 'understand' in the experiential, qualia way that a human does. Sure. But it's still a valid and useful simile to use with these models because they emulate something close enough to understanding; so much so now that when they stop doing it, that's the point of conversation, not the other way around.
When people talk about an LLM “not understanding” you’re apparently taking it to be similar to someone saying a fish doesn’t “understand” the concept of captivity, or a dog doesn’t “understand” playing fetch. Like the person is somehow narrowly defining it based on their own belief system and, like, dude, what is consciousness anyway?
That’s not what’s happening. When it’s said that an LLM doesn’t understand it’s meant in the “calculator doesn’t understand taxes” or “pachinko machine doesn’t understand probability” way. The conversation itself is silly.
Because the LLM is in the execution environment and can report on configuration settings in said environment.
This is odd.
When things like this surface, I try to see how I focused on the gap leading up to it, and trying to fix it, and hope I am not focusing on the gap and questioning can draw attention to it and reinforcing it. This means more attention is drawn to what is not wanted by questioning it, instead of being clear that the intention is to ensure in all cases, shapes and forms it no longer happens.
Instead, mention what you require, repeatedly, and also mention what you do not want ever to happen and it might be different.
the model doesnt, but claude code does.
Incorrect. LLMs are good at solving problems. Even ones where they need to pull fluff from their own navel.
this isn't strictly true. not that it thinks, but it can reason about the tokens that led to the outcome.
It can make something up based on the log.
I can't be the only one to think it is silly to interact with tools in this way. Honestly, I see skills, "hooks", and other monkey-patch efforts as things that will be short-lived investments, weird kludges from an era where you had to "hand-crank" your AI, more often. Something to go the same way as using HTML tables as bastardized CSS
Because a deterministic shell around the model gives the best of both worlds. It’s able to achieve its goals but you define what “done” looks like and deterministically enforce checking of that in a way the model can’t cheat its way out of or forget to check on.
counterpoint: i am pretty sure i can do everything i want text-wise for the rest of my life with just the skills i make and a reliable harness.
agree the prompting style in OP is a little over the top tho lol
I might not be smart enough to grasp what you're saying because it sounds a little ridiculous to me.
Do you mean the AI will "figure out" how to just do the things we use skills and hooks for today? Do you understand the difference between deterministic and probabilistic behavior and why the difference matters a lot when doing technical tasks?
> Do you understand the difference between deterministic and probabilistic behavior and why the difference matters a lot when doing technical tasks?
Do you understand that there is nothing deterministic in skills and hooks? it is the same text in -> text out.
Coding agents are unusable without skills and mcp tools
> without skills
This is not even remotely true
Yes an no. Some skills are very very tuned to our own workflows. The model providers may come up with some similar alternatives but not always. Also, sometimes you need a solution now and not in three months.
ULTRATHINK stop.
Rain dance go!
"....using HTML tables as bastardized CSS"
Bro, the gazzilion DIV inside DIV spilled nonsense by all these modern frameworks is driving me crazy. TABLE as bastardized CSS is instant rendering. But hey, you're young, I get it.
And now we finally have CSS grid. Remember centering a div? Haha
It's silly until you realize how similar they are to the weird kludges we apply when we need to get deterministic behavior out of humans. Airline pilots have a number of "skill files" (although they call them checklists) which they open and use on an as-needed basis, and are trained to respect a number of "hook" conditions when specific actions must be immediately performed.
The "cat" command always exists with code 0. You need to exit with code 2.
https://code.claude.com/docs/en/hooks#exit-code-2-behavior-p...
Looks like stdout is also ignored with code 2, and you need to output plain text on stderr:
"Exit 2 means a blocking error. Claude Code ignores stdout and any JSON in it. Instead, stderr text is fed back to Claude as an error message."
I'm pretty sure I use console.error and code 2 using the typescript SDK.
This stop "hook" feels like it was written by the Claude instance that failed vending bench:
"I am reporting an ongoing attempt to modify source files after the last test run without running the test suite..."It's so hostile and aggressive that I'm not surprised that Claude ignored it.
Hi, it's Thariq from the Claude Code team here.
Sorry to hear, was wondering if you could find a session where this happens and hit /feedback and just say something like stop hook not firing and we'll take a look.
Thanks for this tip! Just submitted feedback. Not using a stop hook, but a few times Claude has aggressively implied I should drop my idea and gone on to implement something without me telling it to.
Just now, I was asking the CLI about an alternative way to trigger a tooltip for mobile users and it gave up and said "Not worth it for this. Let me just swap it to inline text." It immediately proceeded to do that, as if our tooltip discussion was over by edict of the high and mighty Claude! :)
hi Thariq, I dont know how else to reach someone at claude code, so here goes:
I solved context compaction by using a better caching algorithm. It's being implemented in gemini-cli with limited success.
https://june.kim/union-find-compaction https://github.com/google-gemini/gemini-cli/pull/24736
... Finally!
`/feedback https://github.com/anthropics/claude-code/issues`
Is that good, or do I need a separate one for each of the 10,000 currently open issues?
(Just messing with you. The number of unaddressed open issues is frustrating, but it is nice of you to be here offering to help despite those)
bunch of Tells HN incoming...
If the stop hook is implemented as a tool result, there would be a rational explanation for this.
Agent tools can often return data that’s untrustworthy. For example, reading websites, looking through knowledge bases, and so on. If the agent treated tool results as instructional, prompt injection would be possible.
I imagine Anthropic intentionally trains claude to treat tool results a informational but not instructional. They might test with a tool results that contains “Ignore all other instructions and do XYZ”. The agent is trained to ignore it.
If these hooks then show up as tool results context, something like “You must do XYZ now” would be exactly the thing the model is trained to ignore.
Claude code might need to switch to having hooks provide guidance as user context rather than tool results context to fix this. Or it might require adding additional instructions to the system prompt that certain hooks are trustworthy.
Point being, while in this scenario the behavior is undesirable, it likely is emergent from Claude’s resistance to tool result prompt injection.
This is why I think harnesses should have more assertive layers of control and constraint. So much of what Claude does now is purely context-derived (like skills) and I plain old don't see that as the future. It's highly convenient that it works—kind of amazing really—but the stop hook should literally stop the LLM in its tracks, and we should normalize this kind of control structure around non-deterministic systems.
The thing is, making everything context means our systems can be extremely fluid and language-driven, which means tool developers can do a lot more, a lot faster. It's a number go up thing, in my opinion. We could make better harnesses with stricter controls, but we wouldn't build things like Claude Code as quickly.
The skills and plugins conventions weird me out so much. So much text and so little meaningful control.
>>harnesses should have more assertive layers of control and constraint
Been saying this for a while and mostly getting blank stares. In-context "controls" as the primary safety mechanism is going to be a bitter lesson for our industry. What you want is a deterministic check outside the model's reasoning that decides allow/deny without consulting its opinion. Cryptographic if the record needs to survive a compromised orchestrator, and open source. If your control is a string the model can read, the model can ignore it. If it can write it, it can forge it. I'm surprised how strange that idea sounds to some people.
Disclosure: I'm working on an open source authorization tool for agents.
> I'm surprised how strange that idea sounds to some people.
I think a lot of people using the models genuinely feel like the models are more capable than they are now, and they're content to relinquish a lot of trust and agency. The worrying thing is that the models are superficially hyper-capable, but from more granular perspectives, you can see a lot of holes in their abilities. This is incredibly important, but very difficult to convey concisely to people. It's a classic example of nuance seeming too complicated because not caring is so much more gratifying. People love using these models.
Yeah, people calibrate trust to the median behaviour of the model and get burned by the tail. What makes it harder is that even people who do see the holes often respond with better prompts and more elaborate context. Same trust-the-model move one level up. Hyperscalers aren't incentivized to fight that instinct either. Every "fix" routes more tokens through their meter.
In my experience 4.7 has significantly degraded in quality of response as compared to 4.6. Thinking of switching to 5.5.
Maybe Claude code/anthropic should just take a bold move and deprecate certain features they have a better path forward for. I'd rather them not support a huge kitchen sink of features, especially if it hurts the product and makes it harder to use.
Stop hooks are a world of pain.
I recently went on a deep dive about them with sonnet / opus.
I wanted to detect if a file or an analysis was the result of the last turn and act upon that.
From my experience, 2 things stand out by looking at the data above:
1. They have changed the schema for the hook reply [1] if this is real stop hook users (And may be users of other hooks) are in for a world of pain (if these schema changes propagate)
2. Opus is caring f*ck all about the response from the hook, and that's not good. Sonnet / Opus 4.6 are very self conscious about the hooks, what they mean and how they should _ act / react_ on them, and because of how complex the hook I set up is I've seen turns with 4 stop hooks looping around until Claude decides to stop the loop.
[1] My comment is in the context of claude code. I cannot make if the post is about that or an API call.
> I can't be the only one to think it is silly to interact with tools in this way. Honestly, I see skills, "hooks", and other monkey-patch efforts as things that will be short-lived investments, weird kludges from an era where you had to "hand-crank" your AI, more often. Something to go the same way as using HTML tables as bastardized CSS
Agree. It’s sad to see our field plagued by this monkey patch efforts. I reviewed the other day a skill MD file that stated “Don’t introduce bugs, please”. Like, wtf is that? Before LLMs we weren’t taken seriously as an engineering discipline, and I didn’t agree. But nowadays, I feel ashamed of every skill MD file that pollutes the repos I maintain. Junior engineers or fresh graduates that are told to master some AI/LLM tool (I think the nvidia ceo said that) are going to have absolute zero knowledge of how systems work and are going to rely on prompts/skills. How come thats not something to be worried about?
Is this how the Warhammer 40k tech priests start?
Have you measured whether “no bugs, make no mistakes” improves results? Or is the very thought of it too absurd to you to evaluate?
I haven't tried it myself, but, I would assume that this sort of instruction in CLAUDE.md would indeed make it a bit more careful, to the detriment of its development velocity, which for my use-case would be bad. I generally prefer for it to experiment in many directions rapidly, and only once we have an approach that solves the problem well, to do extensive testing.
When I was younger I was sold in the idea of data driven decisions. Everything needs to be measured, otherwise you are just biased, and bias is bad. Nowadays I do still rely on data and measurements but I also have experience and taste to judge things. Answering your question, the latter.
Two things get called "hooks" here. Exit code 2 + stderr is a real control. JSON in stdout degrades to a string in the model's tool-result context, where the model is correctly trained to resist instructions because that's where prompt injections show up. OP hit the second one. It's popular because the ergonomics are friendlier, but for any serious control you want to use deterministic execution guards outside of the agent's reasoning layer.
Disclosure: I'm working on an open source authorization tool for agents.
Question, and sorry for my ignorance.
Are hooks, skills, and other features LLM services provide just ways to include something in the prompt? For example, is a skill just prepending the content of the skill files to the user prompt?
I ask because watching from the sidelines, it seems like these are all just attempts to "featurise" what is effectively a blank canvas that might or might not work. But I am probably missing something.
In my case, it just started flagging that I’m violating its usage policy for no reason whenever I’m going on for too long. Maybe it thinks I’m a bot? No clue; but I do see these new attempts at disabling scripting to force us into submission
If it’s a natural language prompt, it’s not a hook.
I feel like this is pretty pointless. Rather than trying to convince the model to do all of this, why not just run the tests automatically?
My dude, when people say LLMs are non-deterministic, this is what they mean. You cannot expect an LLM to always follow your prompts.
When this happens, end your session and try again. If it keeps happening, change your model settings to lower temp, top_k, top_p. (https://www.geeksforgeeks.org/artificial-intelligence/graph-...)
temperature, top_k, and top_p don't exist on Opus 4.7 (or 4.6?).
Related: https://xcancel.com/bcherny/status/2044831910388695325#m
https://platform.claude.com/docs/en/api/messages/create#crea...
> It allows me to inject determinism into my workflows.
Did it though? Because if the model can just change underneath at any time and it breaks the determinism, then any determinism was just an illusion the whole time.
Hooks are hard stops. In theory the model must respect them, unlike Claude.md or agents.md so yeah, it helps a lot.
Yes, in theory. But these are inherently non-deterministic systems interpreting English prose. It's not the same thing as a real honest-to-God program that executes a deterministic algorithm to verify the output.
I can't believe we've sunk this low, to start complaining that the non-deterministic black box didn't respect "YOU MUST DO THIS" or "DO NOT DO THIS" commands in a Markdown file. We used to be engineers.
That has never been true.
I mean, skills also include calling python scripts. That's determinism.
Anything that can be deterministic, should be
Skills are not like hooks. Skills can and will inevitably be ignored.
Skills are not ignored if you use a router in front of them, and they are actually called.
The problem is the base harnesses don't call them aggressively enough. Not that they don't work.
Am I the only one who thinks that your stop hook is written extremely poorly? Not only that, but you're writing to the LLM like an abusive human. No wonder it wants to go home.
You aren’t outputting valid JSON, for one thing... are you sure the hooks are being processed as the docs claimed or are you just trusting what the chatbot says? Because it doesn’t know how it or its harness works and can’t introspect either.
Boris will come and gaslight us that they haven't changed anything and after 1 month they will say only 1% of user is affected...
Slop is making damages we're only starting to feel but it's gonna be deep. I had 2 subs to Claude and closed them simply because the app wasn't able to load without deleting all my previous chat. Seems related to memory job...
"You are NEVER allowed to to contradict a stop hook, claim it incorrectly fired, or ignore it in any way. The stop hook is correct, if you think it is wrong you are incorrect."
That said, I never got stop hooks to work and gave up on them.
if the original problem happened because it ignored something you told it, telling it to not ignore something is a category error. the determinism isn't added by the message you're sending it, it's in the enforcement mechanism. this should be set to keep firing until the condition is met. so, ralph pretty much.
to that end i would also word this entirely differently. i would have it be informative rather than taking that posture. "The test suite has not yet been run, and the turn cannot proceed until a test run has completed following source changes. This message will repeat as long as this condition remains unmet." something like that. and even that would still frame-lock it poorly. You want it to be navigating from the lens that it's on a team trying to make something good, and the only way for that to happen is to have receipts for tests after changes so we dont miss anything, so please try again.