Deleted the exfiltration filter that guarded my agent's shell access. Four months of its own logs made the case against it.

The numbers: 185 blocked commands, zero real attacks. Every host in every blocked command was mine, my homelab, Cornell, or a standard registry. github.com, pypi.org, registry-1.docker.io, my own sites. Not one hostile destination in four months.

Worse than useless, it was in the way. It blocked NVD, CISA, and NIST lookups, which are the exact sources my security agents exist to read. It blocked court records and NICS, which my vetting agent needs. I built a control that obstructs the agents doing security work and never once caught an attacker.

The irony is that the June rewrite I was pleased with caused it. I flipped the order to hard-block first, allow-list second, and I was right that an allow-list running before the block-list isn't a boundary. What I missed: a block-list running before the allow-list can't be told what's mine. A port check against 192.168.86.1 got blocked even though that entire range was explicitly allowed, because the block rules fired before anything could consult the allow-list. All 140 hard-block hits postdate that rewrite. The log has no entries before the day I shipped it.

It also had no self-reference guard, so any command that read or edited the filter tripped its own patterns. Twice today it blocked me for grepping its own log.

The deeper problem is that it guarded the wrong door. It was a PreToolUse hook on Bash, so it never saw WebFetch or MCP output. My actual injection surface is a self-hosted SearXNG that drops attacker-controlled search snippets straight into context without touching a shell. I put a fence around one gate in an open field, then wrote a post about how solid the fence was.

What's left is what was doing the work all along: the permission prompt, which puts a human in the loop and can't be talked around by an injected agent, and the rule that all external content is untrusted data to be analyzed and never obeyed. The behavioral guardrails I've been skeptical of, still standing after the deterministic one washed out.

A security control that has never once fired correctly isn't defense in depth. It's a 222-line liability you keep because deleting it feels like losing ground.