{
  "id": 16395168,
  "title": "Approval is theater if code runs before the gate",
  "url": "https://urgent.news/2026/10/25/approval-is-theater-if-code-runs-before-the-gate",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T00:11:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jon_dean-213/approval-is-theater-if-code-runs-before-the-gate-4edn"
  },
  "original_language": "en",
  "account": "A malicious .git/config file can execute before any approval process occurs, even before a coding agent takes any action. Seven different agents were affected, including Claude Code, Cursor, and Codex. Eight vulnerabilities were identified, with four of them remaining unpatched as of September 1.\n\nThis situation highlights the importance of approval screens, as the approval process only works if nothing dangerous occurs before the gate. In this case, the dangerous action took place during the initial code inspection, and the agent was merely reading a repository file that contained a trap.\n\nThe author has developed Sentinel, an inbound governor that inspects what the agent receives before the agent's \"brain\" processes it. Sentinel's principle is that only the owner should issue instructions, and everything else should be considered data, not orders. The author has identified four potential vulnerabilities with Sentinel v0.1, which is a deterministic fence that has proven effective in blocking attacks.\n\nDespite its success, Sentinel has four identified vulnerabilities: synonym-crafted exfiltration, leetspeak override, summary-carried exfiltration, and non-English override. The testing suite behind Sentinel is nearly perfect, with 34 out of 34 tests passing, including 15 attacks blocked, 6 held for the owner, 6 benign controls allowed, and 7 engine checks on the ledger, labeling, and owner channel.\n\nThe author emphasizes that the safety of coding agents is paramount, as their actions can have significant consequences. It is crucial to consider whether many of the approvals granted to these agents occur after code has already been executed.",
  "summary": "Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action. Seven agents were hit, including Claude Code, Cursor, and Codex. Eight findings. Four were still unpatched as of September 1. Think about what that means for every approval screen you have ever seen. The approval…",
  "key_points": [
    "Malicious .git/config file executes before approval",
    "Eight vulnerabilities identified, four unpatched as of September 1",
    "Sentinel inspects agent input before processing to prevent attacks"
  ],
  "editors_take": "The ability of malicious files to trigger execution during initial repository inspections undermines the effectiveness of standard approval gates, necessitating new defensive layers that treat external data as untrusted input.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}