Desktop app: dangling plugin hook (security_reminder_hook.py missing) fires endless 'Background security review found issues' notifications

What happens

In the Claude desktop app (Code tab, Windows 11), a plugin hook keeps firing a "Background security review found issues" notification into the session. Each notification wakes the model, which replies, which triggers the next one, so the session loops indefinitely and drains the laptop battery. Pressing Stop / sending "stop" does not end it, because the next notification restarts a turn.

The error carried by every notification

python3.11.exe: can't open file
'C:\Users\<user>\AppData\Roaming\Claude\local-agent-mode-sessions\<session-id>\<account-id>\rpm\plugin_01YBNfaNwQztYsnUydt8m47G\hooks\security_reminder_hook.py': [Errno 2] No such file or directory

The same missing script also appears as a blocking PostToolUse:Write hook error (hooks/sg-python.sh calling hooks/security_reminder_hook.py).

Why it looks like a bug

• The script path under rpm\plugin_01YBNfaNwQztYsnUydt8m47G\hooks\ does not exist on disk, yet the hook is still registered.
• Customize > Plugins shows "Add your first plugins" (empty), so the user has no installed plugin to remove. The hook seems to come from a remotely/account-managed plugin that the UI does not list.
• The failure is reported as a security finding ("found issues") rather than a hook execution error, so the model treats it as feedback to act on.

Expected

• A hook whose script is missing should be skipped or surfaced once as a configuration error, not delivered repeatedly as review feedback.
• Automated hook notifications should not be able to trigger unbounded model turns.
• The user should be able to see and disable the plugin that owns the hook.

Environment

Claude desktop app, Code tab, Windows 11 Pro 10.0.26200, model Sonnet 5, auto mode.