{"slug": "gate-cat-stopping-ai-agents-from-running-rm-rf", "title": "Gate.cat: Stopping AI Agents from Running rm -rf", "summary": "Gate.cat, an open-source tool from BGMLAI, intercepts shell commands from AI agents before execution to block dangerous operations like rm -rf, using a fail-closed parser with no LLM call in the veto path. In testing on 1,085,159 unique agent commands, it achieved zero misses and caught 178/178 dangerous shapes, blocking only ~0.6% of real-world commands. The tool offers deployment via Claude Code hook, gated shell, or local proxy, and is available under Apache-2.0 at github.com/BGMLAI/gate.cat.", "body_md": "# Gate.cat: Stopping AI Agents from Running rm -rf\n\n*after*the command finishes. Gate.cat actually intercepts the execution before the shell even sees the command.\n\nThe core logic here is fail-closed: if the tool can't parse the command, it blocks it. Crucially, there is no LLM call in the veto path. This means a clever prompt injection can't \"convince\" the gate to let a dangerous command through because the gate isn't listening to the model; it's analyzing the string and path.\n\n## Deployment Options\n\nDepending on your AI workflow, there are three ways to plug this in:\n\n1. ** Claude Code hook**: This is the most secure method since enforcement happens in the harness. Run\n\n`pip install gate.cat`\n\nand update your `.claude/settings.json`\n\nby adding `gatecat-hook`\n\nto the matcher for `Bash|Write|Edit`\n\n.2.\n\n**Gated shell**: Works for any CLI agent that honors the\n\n`$SHELL`\n\nvariable (like aider or Codex) via `gatecat-shell`\n\n.3.\n\n**Local proxy**: For those using Ollama, vLLM, or OpenRouter, you can just swap the\n\n`base_url`\n\nto route through the proxy.## Performance Data\n\nThe project includes a `FACTS.md`\n\nfile with reproducible artifacts. According to their data:\n\n**Command Testing:** 1,085,159 unique agent commands from public datasets were replayed; zero misses after adjudication.**Bypass Suite:** 178/178 dangerous shapes were successfully caught.**Intervention Rate:** Only ~0.6% of real-world commands are actually blocked, meaning it doesn't get in the way of actual work too often.**Policy Walls:** Comes with 71 default policy walls.\n\n## The Reality Check\n\nThis isn't a magical \"safety proof.\" It's a wall against known-dangerous patterns. If a command doesn't match a danger shape, it goes through. It should be used as a layer of defense *alongside* a sandbox, not as a replacement for one.\n\nIt's Apache-2.0 and has a zero-dependency core.\n\n```\npip install gate.cat\n```\n\nSpecific project details:\n\n```\nhttps://github.com/BGMLAI/gate.cat\n```\n\n[Next LLM Eval Strategy →](/en/threads/2479/)", "url": "https://wpnews.pro/news/gate-cat-stopping-ai-agents-from-running-rm-rf", "canonical_source": "https://promptcube3.com/en/threads/2489/", "published_at": "2026-07-23 19:02:11+00:00", "updated_at": "2026-07-24 03:37:19.974821+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools"], "entities": ["Gate.cat", "BGMLAI", "Claude Code", "Ollama", "vLLM", "OpenRouter"], "alternates": {"html": "https://wpnews.pro/news/gate-cat-stopping-ai-agents-from-running-rm-rf", "markdown": "https://wpnews.pro/news/gate-cat-stopping-ai-agents-from-running-rm-rf.md", "text": "https://wpnews.pro/news/gate-cat-stopping-ai-agents-from-running-rm-rf.txt", "jsonld": "https://wpnews.pro/news/gate-cat-stopping-ai-agents-from-running-rm-rf.jsonld"}}