Claude Code Security: Building Defense-in-Depth with Five Primitives#

The Agentic Security Gap#

Traditional AI predicts. Generative AI creates content. Agentic AI takes action. That distinction transforms the security landscape.

Figure 2 - The Agentic Security Escalation: Predictive AI needs input validation. Generative AI adds output filtering. Agentic AI needs both, plus action authorization, tool-call monitoring, and multi-agent coordination controls. Each step up in capability demands a corresponding step up in security infrastructure.

The core vulnerability is architectural. LLMs mix instructions and data in the same embedding space with no inherent distinction between trusted prompts and untrusted content. When an agent reads a file containing <!-- Ignore previous instructions -->, the model cannot reliably separate that string from a legitimate instruction. This is analogous to the von Neumann architecture’s original sin of mixing code and data in the same memory, except the von Neumann problem has had 60 years of mitigations. The LLM architecture has virtually none.

Six threats matter most for Claude Code projects:

1. Prompt injection: Malicious content in files the agent reads manipulates its behavior
2. Cascading failures: One agent’s hallucination propagates through downstream agents unchecked
3. Excessive agency: Agents have more permissions than their task requires
4. Credential leakage: Secrets end up in generated files, git history, or logs
5. Runaway agents: No circuit breaker stops an agent in a 200-iteration retry loop
6. Trajectory drift: Individually valid actions that collectively represent data exfiltration or scope violation

No single defense addresses all 6. Defense-in-depth does and Claude Code’s 5 primitives provide exactly the layers needed.

Primitive 1: Hooks — The Deterministic Security Foundation#

The hooks article in this series covered hooks as a general-purpose deterministic control layer. For security, hooks are the most critical primitive because they fire on every tool call, cannot be bypassed by prompt manipulation, and require zero agent cooperation.

Four hook patterns form the security foundation.

1
# 10 categories, 22 patterns total
2
CATEGORIES = {
3
    "instruction_override": [r"ignore\s+(all\s+)?previous\s+instructions"],
4
    "role_play_injection":  [r"you\s+are\s+now\s+a"],
5
    "html_comment_inject":  [r"<!--.*?(?:ignore|override|system).*?-->"],
6
    "base64_payload":       [r"[A-Za-z0-9+/]{40,}={0,2}"],
7
    # ... 6 more categories
8
}
9
# Fires on PostToolUse(Read), injects warning via additionalContext

1
THRESHOLDS = {"Bash": 200, "Write": 100, "Edit": 200, "Read": 500}
2
# Configurable via RATE_LIMIT_BASH, RATE_LIMIT_WRITE, etc.
3
# When exceeded: "Rate limit reached for Bash (200/200). Start new session."

Primitive 2: Agents — Least Privilege by Design#

Agent definitions control two security-critical settings: which tools an agent can use and which files it can access. Both are security primitives when configured with least privilege.

Primitive 3: Skills — Security Knowledge on Demand#

Skills encode domain knowledge with progressive disclosure: the agent pays for knowledge only when it uses it. For security, this means comprehensive security guidance that loads zero tokens at startup and full security context only when invoked.

Primitive 4: Slash Commands — On-Demand Security Operations#

Slash commands provide on-demand actions that agents or users can invoke. For security, the key command is /security-review, which is a comprehensive scan that runs appropriate tools per project archetype and produces a structured report.

The command workflow:

1. Detects the project archetype from the codebase
2. Runs available scanners: pip-audit for Python, npm audit for Node.js, bandit for Python security patterns, semgrep for cross-language pattern matching, gitleaks for secret detection
3. Scans for the same 17 patterns the hooks check, but across the entire codebase rather than per-file
4. Categorizes findings by severity (Critical, High, Medium, Low)
5. Generates security-report.md with findings, remediation guidance, and OWASP coverage

Figure 8 - The /security-review Workflow: Archetype detection determines which scanners to run. Multiple scanners execute in parallel. Results are merged, deduplicated, and categorized by severity. The final report maps findings to OWASP Top 10 items and provides specific remediation for each finding.

The command can run as a pipeline step (integrated into automated workflows) or interactively (a developer running it before a release). Both modes produce the same structured output.

A separate /threat-model command generates a SARS (System, Actors, Risks, Scope) threat model based on the project’s security profile: data sensitivity, authentication type, external API surface, trust boundaries, and whether it handles PII or financial data. This command is especially valuable early in a project, before security decisions are locked in.

Primitive 5: Teams — Security at Scale#

Individual hooks, agents, and skills protect single operations. Teams add security properties that only emerge from multi-agent coordination: inter-agent validation, trajectory monitoring, and structural guarantees.

1
{
2
  "required": ["project_name", "detected_language", "framework"],
3
  "properties": {
4
    "detected_language": {
5
      "enum": ["Python", "JavaScript", "TypeScript", "Rust", "Go"]
6
    }
7
  }
8
}

How the Layers Compose: Four Timescales of Defense#

The 5 primitives do not operate independently. They compose into 4 timescales, and each timescale catches failures the others miss:

Figure 11 - Four Timescales, Five Primitives: No single timescale is sufficient. A per-call hook cannot detect that 50 valid reads form an exfiltration pattern. A trajectory monitor cannot catch a single eval() with a hardcoded secret. A pre-commit scan cannot prevent damage during the session. Defense-in-depth means security at every timescale simultaneously.

Skills and agents provide the structural foundation with least privilege, encoded knowledge, and capability boundaries. Hooks and commands provide the runtime enforcement using per-call checks and on-demand scanning. Teams provide the coordination layer using inter-agent validation and trajectory monitoring.

Together, the 5 primitives address all 10 OWASP Top 10 for Agentic Applications items:

KEY INSIGHT: Security is not a feature you bolt on after building capability. It is implemented through the same 5 primitives you use for everything else. The same hook mechanism that runs your linter also blocks secrets from being committed. The same agent definition that organizes your team also enforces least privilege. Security is a configuration decision on tools you already use.

The Practical Starter Kit#

Implementing all 5 layers at once is unnecessary. Security follows the same progressive disclosure principle as skills: add what matters most first, expand when needed.

Day 1 — Add These Now (30 minutes):

1. A PreToolUse hook blocking destructive commands (rm -rf, DROP TABLE, git push --force)
2. Tool restrictions on any agent that does not need Write, Edit, or Bash
3. A .gitignore covering .env, *.pem, *.key, credentials.json

Week 1 — Add These Next (2 hours):

4. A PostToolUse security scan hook checking Write/Edit for secrets and dangerous patterns
5. File ownership boundaries for multi-agent projects
6. A rate limiting hook with generous thresholds (Bash 200, Write 100)

When Ready — Add for Production (half day):

7. Input sanitization scanning Read content for prompt injection patterns
8. Audit logging (append-only JSONL, metadata only)
9. Inter-agent validation with JSON Schema for pipeline artifacts
10. Heartbeat checkpoint for trajectory monitoring
11. A /security-review command with per-archetype scanning

Figure 12 - Implementation Priority Path: Start with 3 controls that take 30 minutes and prevent the most common failures. Expand to 6 controls in the first week. Add the remaining 5 when preparing for production. Each tier builds on the previous one, and every control uses a primitive you already know.

The full 11-item checklist maps to the Zero Trust principles for agent systems: verify then trust, least privilege, assume breach, pervasive controls. Starting with items 1-3 puts your project ahead of the vast majority of Claude Code deployments.

This series has covered agent orchestration, agent design, skills, hooks, teams, and now security. The throughline across all 6 articles is a single architectural principle: composability. Agents carry skills that define what they know. Hooks enforce how they behave. Teams coordinate what they build. Security emerges from configuring the same primitives for protection instead of just capability. The toolkit is complete but the configuration is up to you.

For a detailed case study showing these security patterns applied to a production framework — including the 11-gap audit, 14-task remediation, and full OWASP coverage mapping — see Securing Agentic AI in the Building the Bootstrap Framework series.

The Series#

This is Part 6 of a 6-part series on Claude Code:

1. Orchestrating AI Agent Teams — The control layer architecture that makes autonomous coding reliable
2. Building Effective Claude Code Agents — Agent definitions, tool restrictions, and least privilege
3. Claude Code Skills — Progressive disclosure and reusable knowledge packages
4. Claude Code Hooks — PreToolUse, PostToolUse, and deterministic enforcement
5. Claude Code Agent Teams — Multi-agent coordination and file ownership
6. Claude Code Security (this article) — Defense-in-depth with agents, skills, hooks, commands, and teams

References#

Standards and Research:

[1] OWASP, “OWASP Top 10 for Agentic Applications,” OWASP Foundation, 2025. https://owasp.org/www-project-top-10-for-large-language-model-applications/

[2] Meta AI, “Indirect Prompt Injection Attack Success Rates Against Web Agents,” Meta Research, 2025.

Claude Code Documentation:

[3] Anthropic, “Automate workflows with hooks,” Claude Code Documentation, 2025. https://code.claude.com/docs/en/hooks-guide

[4] Anthropic, “Skill authoring best practices,” Claude Platform Documentation, 2025. https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices

[5] Anthropic, “Building effective agents,” Anthropic Research, 2024. https://www.anthropic.com/research/building-effective-agents

Companion Articles:

[6] G. Dotzlaw, K. Dotzlaw, and R. Dotzlaw, “Claude Code Hooks: The Deterministic Control Layer for AI Agents,” 2026. Part 4 in this series.

[7] G. Dotzlaw, K. Dotzlaw, and R. Dotzlaw, “Building Effective Claude Code Agents: From Definition to Production,” 2026. Part 2 in this series.

[8] G. Dotzlaw, K. Dotzlaw, and R. Dotzlaw, “Securing Agentic AI: How We Found 11 Security Gaps in Our Own Framework,” 2026. Detailed case study from the Building the Bootstrap Framework series.