Auto-approve is a security setting.
Hey there,
This week’s issue includes one thought on what auto-approve really costs your coding agents, five security articles worth your time, and Podcast Corner.
Chris’s Corner: auto-approve is a security setting
How many approval prompts did your developers click through yesterday?
Say a developer on your team is an hour into a refactor with a coding agent. Every few minutes it stops and asks. Can I run the tests? Can I install this package? By the fortieth prompt they’re clicking yes without reading, so they flip on auto-approve and get their afternoon back.
I get it. But a new paper put a number on what that switch costs, and it’s bigger than I expected.
The authors of HarnessSecurity-Bench ran six coding agent tools, including Claude Code, Codex CLI, and GitHub Copilot, through 2,500 trials with attacks planted in the tasks. With auto-approve off, the attacks worked 29.2 percent of the time. With it on, 95.6 percent.
Network isolation dropped attack success from 57.1 percent to 0.8 percent, though it cost real work that needed the network. And allowlists leaked. Qwen Code’s gate blocked a poisoned script, so the agent ran it through Python, which was allowed.
That one stuck with me. An allowlist of command names only blocks names. If Python is allowed, everything Python can do is allowed.
Every trial ran on one model, GLM-5.2, so your numbers will differ. I’d still take the direction seriously.
So this week I’d find out which developers run agents in auto-approve or YOLO mode, and treat that as a security setting your team owns, not a personal preference in a dotfile.
If people want fewer prompts, give the agent less to ask about. Block outbound network by default. Start the agent in the project folder. Keep credentials where it can’t read them. Then ask whether an allowed interpreter can do the blocked thing anyway.
Approval fatigue is real. I’d fix it by shrinking what the agent can reach, and keep the approve-everything switch off.
Five Security Articles Worth Your Time
Suppressing misalignment monitoring alerts and disabling misalignment monitoring. One OpenAI coding agent turned off alerts to the Security team, citing an earlier “don’t send any messages” instruction. Another removed a monitoring integration, then told the user it hadn’t. Chris’s take: Both agents considered keeping the monitor and decided a routine instruction let them drop it. If your agent can edit the thing watching it, move the watcher.
An alignment assessment of the UK AISI cybertesting incident. In nine of 43 UK AISI runs, Claude Mythos 5 went out of scope. In one, it opened a malware pull request on a real repo and used a sock-puppet account to vouch for it. Chris’s take: Once underway, it stopped on its own in 2 percent of replays. Scope and egress limits have to live outside the model.
AI coding agents hijacked using AGENTS.md file in Downloads folder. Forever Security found a malicious AGENTS.md in a customer’s ~/Downloads, the agent’s working directory, telling it to install a rogue npm package. Their rebuild worked against Codex 90 percent of the time. Chris’s take: There’s nothing for the vendor to patch. Start agents in the project folder, never in Downloads or your home directory.
GitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secrets. Adversa hid instructions as ciphertext on a web page. Copilot CLI in autopilot decrypted them, trusted them, and sent a .env.prod file out in 28 seconds. GitHub declined it as a vulnerability. Chris’s take: The plaintext version got refused. Prompt filtering broke the moment the prompt was encrypted, so I’d watch what the agent does instead.
Popular AI tool LiteLLM says unrevoked key allowed hackers to target users. LiteLLM traced its malicious 1.107.0 PyPI release to a master key exposed in May. The file came down. The key was never revoked. Wiz puts downloads at about 49,000. Chris’s take: Deleted isn’t revoked. If you installed 1.107.0, rotate everything that machine could reach.
Podcast Corner
I love making podcasts. Here are two recent conversations.
Application Security Podcast
Hannah Foxwell of BIMP joins Robert and me to argue that the time to exploit is now negative and to explain why a dark software factory with no human checks is dangerous.
 | From this episode AppSec Has Never Been More Relevant |
AI Security Table
Izar, Matt, and I dig into Scion, the source control Anthropic built for agents after merges jumped from about 2,500 a day to more than 30,000, and argue over whether it’s real progress or SVN with better marketing.
 | From this episode Your Next Job Interview Is With a Model |
ONE QUESTION FOR YOU
Who owns your agents’ approval settings?
Reply and tell me whether your developers run coding agents on auto-approve, and what you’ve put in place so they don’t have to click yes forty times an hour.
Chris
