What they did
Alican Kaya spent about two months building Mindgate, an Obsidian vault plus 21 standard-library Python scripts that give Claude Code a persistent memory and put three guards in its hooks: one for shell commands, one for file writes and patches, one for web addresses. Each guard allows, asks or refuses using fixed patterns, with no model inside. Before the 1.0 release the author ran four checks with agents: a security review, a red-team pass, a language review and an audit of the whole history. The red-team agent ran on Opus and was told never to carry out a real attack; its job was to write harmless inputs designed to slip past the guard functions.
How it went
The red-team agent tried about 110 inputs and found 13 bypasses; with the security review that made 14 findings, all fixed in the release commit on 7 November 2026, each with a regression test. Examples: deletes wrapped in bash -c or powershell -Command were never inspected, a quoted rm before a semicolon hid a real recursive delete, Windows device prefixes and data-stream names got writes past the write guard, and quote counting took 82.6 seconds on a 448 KB command. All 22 vault test files and 52 installer tests passed at release.
Worth knowing
The author says plainly the guards are not a sandbox: read tools pass no guard and the hooks run with the user's own rights. Only Windows 11 was tested. The plan is to rerun the red-team agent whenever a hook changes and monthly. The post does not say exactly which harness ran the review agents beyond Opus.