Four loopholes in the denylist approach to auto-approving AI agent commands

Описание и применение

Автоматический скрипт, который нажимает кнопку одобрения команд AI‑агента, использовал список запрещённых слов, что позволило 14 из 18 опасных команд пройти. Переписав логику на основе списка разрешённых, авторы устранили все ошибки, но оставили риск неполноты списка.

Задача

An automated approval script that clicks the approval button for an AI agent’s shell command incorrectly allows dangerous commands due to a denylist implementation.

Результат

The allowlist implementation prevented all 18 must‑not‑click examples from being approved, whereas the denylist implementation allowed 14 of them.

Рабочий процесс

• 1. Capture the Command: line from the approval dialog.
• 2. Split the command into fragments at shell separators (&&, ;, |, etc.).
• 3. For each fragment, check for any forbidden symbols (12 types).
• 4. Verify the first word is one of 15 allowed executables.
• 5. Resolve all paths (output targets, cd destinations, other arguments) relative to the working directory.
• 6. Ensure no resolved path lies outside the working directory.
• 7. If all fragments pass, click the "allow once" button; otherwise, do not click and return the reason.

Доказательства

The comparison run on 2026-10-12 found that it decided to click the button in 14 of them.

Источник

The allowlist implementation does not click the button for correct operations that it does not list.

Источник