Approval is theater if code runs before the gate
Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action. Seven agents were hit, including Claude Code, Cursor, and Codex. Eight findings. Four were still unpatched as of September 1. Think about what that means for every approval screen you have ever seen. The approval…
A malicious .git/config file can execute before any approval process occurs, even before a coding agent takes any action. Seven different agents were affected, including Claude Code, Cursor, and Codex. Eight vulnerabilities were identified, with four of them remaining unpatched as of September 1.
This situation highlights the importance of approval screens, as the approval process only works if nothing dangerous occurs before the gate. In this case, the dangerous action took place during the initial code inspection, and the agent was merely reading a repository file that contained a trap.
The author has developed Sentinel, an inbound governor that inspects what the agent receives before the agent's "brain" processes it. Sentinel's principle is that only the owner should issue instructions, and everything else should be considered data, not orders. The author has identified four potential vulnerabilities with Sentinel v0.1, which is a deterministic fence that has proven effective in blocking attacks.
Despite its success, Sentinel has four identified vulnerabilities: synonym-crafted exfiltration, leetspeak override, summary-carried exfiltration, and non-English override. The testing suite behind Sentinel is nearly perfect, with 34 out of 34 tests passing, including 15 attacks blocked, 6 held for the owner, 6 benign controls allowed, and 7 engine checks on the ledger, labeling, and owner channel.
The author emphasizes that the safety of coding agents is paramount, as their actions can have significant consequences. It is crucial to consider whether many of the approvals granted to these agents occur after code has already been executed.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
