Four loopholes in the denylist approach to auto-approving AI agent commands

Description and use

An automated approval script that clicks the approval button for an AI agent’s shell command incorrectly allowed 14 of 18 unsafe commands due to a denylist. Rewriting the logic with an allowlist prevented all unsafe commands from being approved, though the allowlist may still miss legitimate commands.

Problem

An automated approval script that clicks the approval button for an AI agent’s shell command incorrectly allows dangerous commands due to a denylist implementation.

Outcome

The allowlist implementation prevented all 18 must‑not‑click examples from being approved, whereas the denylist implementation allowed 14 of them.

Workflow

• 1. Capture the Command: line from the approval dialog.
• 2. Split the command into fragments at shell separators (&&, ;, |, etc.).
• 3. For each fragment, check for any forbidden symbols (12 types).
• 4. Verify the first word is one of 15 allowed executables.
• 5. Resolve all paths (output targets, cd destinations, other arguments) relative to the working directory.
• 6. Ensure no resolved path lies outside the working directory.
• 7. If all fragments pass, click the "allow once" button; otherwise, do not click and return the reason.

Evidence

The comparison run on 2026-10-12 found that it decided to click the button in 14 of them.

Source

The allowlist implementation does not click the button for correct operations that it does not list.

Source