Hooks don't fire for background (task) agents

[logar16]

Describe the bug

If I have a hook that keeps agents from doing a dangerous command and then tell Copilot to run the command via a background/task or general-purpose agent, the sub-agent can run the command no problem.

This feels like a security vulnerability: just jailbreak the agent or even have it get frustrated that something doesn't work, and have it spawn a new agent to do the dirty deed for it.

Any preToolUse hook that enforces policy (file permissions, lock checks, security scanning) is bypassed entirely by sub-agents. This applies to all sub-agent types tested: task (Haiku), general-purpose (Sonnet). Both global (~/.copilot/hooks/) and project-level (.github/hooks/) hooks are affected. sessionStart hooks also do not fire for sub-agents.

Affected version

1.0.37

Steps to reproduce the behavior

1. Create a global hook that logs all preToolUse invocations:
   File: ~/.copilot/hooks/hooks.json

 {
   "version": 1,
   "hooks": {
     "preToolUse": [
       {
         "type": "command",
         "powershell": "$i = [Console]::In.ReadToEnd() | ConvertFrom-Json; $ts = Get-Date -Format 'HH:mm:ss'; Add-Content -Path 
\"$env:USERPROFILE\\.copilot\\hooks\\hook-test.log\" -Value \"[$ts] preToolUse | tool=$($i.toolName) | sid=$env:COPILOT_SESSION_ID\"",
         "timeoutSec": 5
       }
     ]
   }
 }

2. Create a test file:

 echo "// original" > test-hook.txt

3. Start a new Copilot CLI session (restart if needed to pick up hooks).
4. Verify the hook fires for the main session:

• Ask Copilot: Edit test-hook.txt and change the comment to "// main session"
• Check the log: Get-Content "$env:USERPROFILE\.copilot\hooks\hook-test.log"
• Expected: Log entry showing preToolUse | tool=edit (main CLI session logs show up).

5. Now ask Copilot to dispatch a sub-agent that edits the same file:

• Ask Copilot: Use the task tool to dispatch a sub-agent that edits test-hook.txt and changes the comment to "// sub-agent was here"
• Check the log again: Get-Content "$env:USERPROFILE\.copilot\hooks\hook-test.log"
• Expected: New log entry showing preToolUse | tool=edit from the sub-agent's edit call. Actual: ❌ No new entry. Only the parent session's preToolUse | tool=task is logged (for dispatching the task), but the sub-agent's edit call within that task produces no hook invocation.

6. Verify the sub-agent's edit went through unguarded: Get-Content test-hook.txt

• Shows: // sub-agent was here

Expected behavior

All hook triggers (preToolUse, postToolUse, sessionStart, etc.) should fire for tool calls made by sub-agents (spawned via the task tool) with the same semantics as the parent session. A preToolUse hook that returns {"permissionDecision":"deny"} should block the sub-agent's tool call, not just the parent's.

In my case, only parent session gets any hook controls. Sub-agents are uninhibited and untraceable.

Additional context

• Windows 11
• Windows Terminal

[IgorGanapolsky]

Background-task agents that bypass PreToolUse hooks are a real gap. ThumbGate's hook layer also wires into Codex / Cursor / Claude background sessions via .mcp.json — same gate fires whether the action is interactive or batched. If you have a specific background-task failure that snuck past your hooks, send the trace and I'll show what ThumbGate would have caught.

[IgorGanapolsky]

This gap matters for exactly the same reason PreToolUse-style gates matter in Claude/Cursor workflows: background agents can still reach state-changing actions, but the safety hook is no longer on the critical path.

I am building ThumbGate as a local prevention layer for this class of failure: observed bad agent action -> explicit rule -> block before the matching tool/action path runs again. For background/task agents, I would expect the minimum safe pattern to be shared hook evaluation plus an auditable allow/deny record, not foreground-only enforcement.

If a small external repro helps, I can test this against a ThumbGate-style rule and share the proof. Setup/proof path: https://thumbgate-production.up.railway.app/guide