Four loopholes in the denylist approach to auto-approving AI agent commands

说明与用途

自动化脚本在 AI 代理执行 shell 命令前点击同意按钮时，使用了禁止词列表，导致 18 条不应同意的测试用例中有 14 条被错误批准。改用允许列表后，所有不应同意的用例均被阻止，但允许列表可能仍缺失合法命令。

问题

An automated approval script that clicks the approval button for an AI agent’s shell command incorrectly allows dangerous commands due to a denylist implementation.

结果

The allowlist implementation prevented all 18 must‑not‑click examples from being approved, whereas the denylist implementation allowed 14 of them.

工作流

• 1. Capture the Command: line from the approval dialog.
• 2. Split the command into fragments at shell separators (&&, ;, |, etc.).
• 3. For each fragment, check for any forbidden symbols (12 types).
• 4. Verify the first word is one of 15 allowed executables.
• 5. Resolve all paths (output targets, cd destinations, other arguments) relative to the working directory.
• 6. Ensure no resolved path lies outside the working directory.
• 7. If all fragments pass, click the "allow once" button; otherwise, do not click and return the reason.

证据

The comparison run on 2026-10-12 found that it decided to click the button in 14 of them.

来源

The allowlist implementation does not click the button for correct operations that it does not list.

来源