[BUG] How to limit @-autocomplete injections?

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am helping my company implement Claude Code for our engineering team but we want to put strict rules in place on what Claude can and cannot access. For this we have been working on a managed-settings.json ruleset with custom hooks and rules.

It has been working pretty well until we found that when you mention a file (e.g:"hey whats in `@hooks/text.txt") it seems to just bypass any rules put in place and just inject the content of the mentioned file into the prompt and send it to Claude.

One of the hooks we have uses Trufflehog to detect if the file Claude is trying to access contains any types of secret. And here is an example of using both a path based request without autocomplete vs with autocomplete:

Without autocomplete:

<img width="2722" height="364" alt="Image" src="https://github.com/user-attachments/assets/956cb942-8cbb-4d67-b9e5-716e787ff03c" />

With @-autocomplete:

<img width="3198" height="544" alt="Image" src="https://github.com/user-attachments/assets/d79228fc-d5c0-4edb-b360-ab65b5072824" />

As we can see for the same file, but with different access method Claude just ignores the hook into place when accessed with autocomplete.
The hook is a PreToolUse hook and is defined as such in the managed setting:

"PreToolUse": [
      {
        "type": "command",
        "command": "/Library/Application\\ Support/ClaudeCode/blacklisted_files.py"
      }
    ]
  }
],

My question is has anyone been able to limit this behavior? Maybe using UserPromptSubmit? Any tips are welcomed, thank you !

What Should Happen?

Prevent content of blacklisted files from being injected into the chat. Currently using auto-complete bypasses the rules put in place.

Error Messages/Logs

Steps to Reproduce

1. PreToolUse that denies read of a specific file
2. @-autocomplete the file thats supposed to be denied access.

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.72 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

PyCharm terminal

Additional Information

_No response_