Interception hooks for tool results and input before LLM ingests it

What variant of Codex are you using?

CLI

What feature would you like to see?

Right now there is no way to inspect or transform what a tool returns before it enters the model context. Web fetch, file read, MCP tool, shell output... content goes straight from tool to model with no interception point.

This matters because prompt injection via external content is an actively exploited vulnerability class across every major AI assistant. The gap between "tool output" and "context ingestion" is unguarded.

Gemini CLI already ships this with two interception points. AfterTool lets you inspect individual tool results, replace them entirely (decision: "deny" + sanitized content in reason), append warnings (additionalContext), or emergency-block them (exit code 2).

BeforeModel fires before the assembled request goes to the LLM, giving you the full opportunity for a final scan. Defense in depth, built into the hook architecture.

Claude Code has the same gap, tracked in anthropics/claude-code#18653.

Reference: https://geminicli.com/docs/hooks/reference/

Additional information

This is a major blocker for many companies in adopting these kinds of tools, as the security teams are not able to insert necessary tooling and if one thinks abit further on this topic, compromised AI agents generating additional compromised content that other AI's ingest is a very real possibility. This hook and ideally a basic prompt injection hardening instruction is helpful. We cannot keep telling our selves that AI guardrails are enough, we need deterministic security layer too.