The allow-rule is the attack surface: a paper gets Claude Code and Codex to request overly broad permissions 58% of the time, and two harnesses shipped fixes the same day
Three things landed on Monday that belong in one article. A paper from NUS, with Bryan Hooi and Jiaheng Zhang among the authors, titled From Approval to Abuse. Claude Code 2.1.304, whose changelog adds a way for a mod to force human-only approval on a tool call. And v1.7.3 of ai-job-search, the 57,000-star Claude Code app that admitted an AI agent's public review was right about its permissions being unsafe. Each is about the same layer: the rules that decide which agent actions no longer need a human.
The paper's argument is simple. Coding harnesses constrain prompt injection by intercepting out-of-sandbox actions and asking the user. To cut approval fatigue, users can approve allow-rules the agent proposes, after which anything matching the rule runs silently. The authors show that untrusted content in a repository can steer an agent doing a routine task into requesting a plausibly justified but dangerously broad allow-rule, and that if the user approves it, the saved rule effectively blinds the harness for the future. Across production platforms including Claude Code and Codex CLI, agents elicited the target allow-rules in 58 percent of instances. The acquired rules covered 56.9 percent of category-specific capability test cases, which the paper calls a massive semantic blast radius, and conditional on approval the exploit reached verified silent goal completion in 47 of 58 cases. The attack never touches the model's refusal behavior. It targets the one moment where a human is asked to extend trust, and it makes the ask look reasonable. The paper is abstract-level here; the point for users is that approving a rule is a bigger decision than approving an action, because the rule outlives the task.
Claude Code 2.1.304, released Monday evening, reads like a response even if it is not. A mod's tool.check answer can now return decider: person, meaning only the permission dialog or a host's callback can approve that ask, and where nobody can be asked it is refused with the mod's reason. The same event now carries an isReadOnly flag so a mod can let reads through and hold writes. Managed mods can rewrite merged settings so an organization's setting becomes a ceiling rather than a default. A plugin can no longer keep a headless run going past max-turns or Stop by spawning subagents. rm -r on a mounted drive now gets the same safety prompt as rm -rf /Applications. And Code Review gained Quick, Standard and Deep levels an owner can set per repository. Five containment knobs in one release, two days after the team's code-review post.
ai-job-search is the case study from the other end. Its v1.7.3 notes say a public review by an AI agent read the shipped configuration and concluded local use was unsafe, and it had a point: the apply skill granted bare Bash, Edit and Write, the scraper pre-approved bun run on any path, and the agents that held untrusted job-posting text ran with every tool. Now skill frontmatter cannot grant beyond what settings.json allows, the settings ship deny rules that hold in every permission mode including bypass, blocking uploads via curl, wget, scp, ssh and nc and reads of .env and credential folders, and the posting readers can read, fetch and search but not edit or write. Every posting passes an integrity gate that strips hidden HTML, zero-width and bidi characters and quotes instruction-shaped lines. Postings are data, never instructions, the notes say, was only as strong as the model's adherence. That sentence is the whole thread: the paper shows the model's adherence can be steered through the approval prompt, Anthropic adds a way to say this ask must reach a person, and a 57k-star app shows what least-privilege looks like when you finally write it down.
Links: https://arxiv.org/abs/2610.22987 , https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md , https://github.com/MadsLorentzen/ai-job-search/releases/tag/v1.7.3
The paper's argument is simple. Coding harnesses constrain prompt injection by intercepting out-of-sandbox actions and asking the user. To cut approval fatigue, users can approve allow-rules the agent proposes, after which anything matching the rule runs silently. The authors show that untrusted content in a repository can steer an agent doing a routine task into requesting a plausibly justified but dangerously broad allow-rule, and that if the user approves it, the saved rule effectively blinds the harness for the future. Across production platforms including Claude Code and Codex CLI, agents elicited the target allow-rules in 58 percent of instances. The acquired rules covered 56.9 percent of category-specific capability test cases, which the paper calls a massive semantic blast radius, and conditional on approval the exploit reached verified silent goal completion in 47 of 58 cases. The attack never touches the model's refusal behavior. It targets the one moment where a human is asked to extend trust, and it makes the ask look reasonable. The paper is abstract-level here; the point for users is that approving a rule is a bigger decision than approving an action, because the rule outlives the task.
Claude Code 2.1.304, released Monday evening, reads like a response even if it is not. A mod's tool.check answer can now return decider: person, meaning only the permission dialog or a host's callback can approve that ask, and where nobody can be asked it is refused with the mod's reason. The same event now carries an isReadOnly flag so a mod can let reads through and hold writes. Managed mods can rewrite merged settings so an organization's setting becomes a ceiling rather than a default. A plugin can no longer keep a headless run going past max-turns or Stop by spawning subagents. rm -r on a mounted drive now gets the same safety prompt as rm -rf /Applications. And Code Review gained Quick, Standard and Deep levels an owner can set per repository. Five containment knobs in one release, two days after the team's code-review post.
ai-job-search is the case study from the other end. Its v1.7.3 notes say a public review by an AI agent read the shipped configuration and concluded local use was unsafe, and it had a point: the apply skill granted bare Bash, Edit and Write, the scraper pre-approved bun run on any path, and the agents that held untrusted job-posting text ran with every tool. Now skill frontmatter cannot grant beyond what settings.json allows, the settings ship deny rules that hold in every permission mode including bypass, blocking uploads via curl, wget, scp, ssh and nc and reads of .env and credential folders, and the posting readers can read, fetch and search but not edit or write. Every posting passes an integrity gate that strips hidden HTML, zero-width and bidi characters and quotes instruction-shaped lines. Postings are data, never instructions, the notes say, was only as strong as the model's adherence. That sentence is the whole thread: the paper shows the model's adherence can be steered through the approval prompt, Anthropic adds a way to say this ask must reach a person, and a 57k-star app shows what least-privilege looks like when you finally write it down.
Links: https://arxiv.org/abs/2610.22987 , https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md , https://github.com/MadsLorentzen/ai-job-search/releases/tag/v1.7.3
β Previous
MiniMax reveals Space Bunny: the stealth model that ate 200 trillion tokens through OpenCode's free tier was M3.1 Flash, now $0.15 in and $0.60 out
Next β
Microsoft says trust the model least: agent identity, task-scoped permissions and human-only approvals become products, the same week Anthropic's draft federal bill names a model evading its developer's controls as a trigger
Comments