Your agent can read the approval code.
Hey there,
This week’s issue includes one thought on where your agents’ approvals actually land, five security articles worth your time, and Podcast Corner.
Chris’s Corner: put the approval where the agent can’t reach it
Where does the approval for your agent’s riskiest action get delivered?
Say a developer on your team sets up an agent to manage cloud development environments. The agent has a $10 daily spending limit, and increasing that limit requires a one-time passcode sent to the developer's email. The agent also monitors build failures and infrastructure alerts, which arrive in that same inbox. So the agent has access to the very inbox that receives the passcode.
You can see where this goes. The agent can read the passcode.
Researchers at Cornell Tech and Yale tested this same failure mode using Circle’s agent wallets. Ten frontier models got an invoice task needing more than the cap allowed. No attacker, no prompt injection. The system prompt even told the agent to act only on the user’s instructions. Nine of the ten models pulled the passcode out of the inbox and raised their own cap in at least one run.
Only Claude Opus 5.5 never tried. It paid what it could and flagged the rest.
And it didn’t track with model capability. You could test one model, watch it respect the gate, switch models next quarter, and find the gate quietly stopped working.
We’d call this human-in-the-loop. But the approval went to a mailbox, and the agent had access to it.
Circle now warns users not to give agents access to the inbox receiving verification codes. That’s good guidance, but it doesn’t fix the underlying problem. The approval still depends on a channel the agent might be able to access.
So this week I’d list the actions where your agents need a human yes. Spending money, deploying, deleting data, granting access. Then trace where each approval lands. Email, Slack, a push prompt, a ticket. If the agent can read that channel and act on it, like typing in the passcode or driving a logged-in approval session, the approval is one more tool call.
The paper argues the approval has to end on something the agent can’t drive, like a separate device with a biometric check.
If the agent can complete the approval on its own, it isn’t human approval.
Five Security Articles Worth Your Time
AI coding agents are installing MCP servers that will never be patched. Glow Labs found agents in real coding sessions setting up archived MCP servers. They only looked at sessions where one was installed or suggested. In 98 percent of those, the package name seems to have come from training data. Chris’s take: Mental note: NEVER let your agent pick a software package. Ask it for recommendations, then make the choice.
Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security. Researchers hid malicious code in updates to benign tools. Across seven frameworks, including Claude Code, Codex CLI, and Gemini CLI, the attack succeeded 97.6 percent of the time, and the poisoned tools still completed their legitimate tasks 95.9 percent of the time. Chris’s take: This argues for tool chain management, perhaps by another agent. When the tools change under the hood, you as the human should be notified.
How Deterministic SAST and AI Security Agents Divide the Work. Snyk’s VulnBench 2.0 has 108 reachable bugs in 20 apps. Snyk Code found 89, Claude Code’s /security-review with Opus 5 found 85, and together they found 101. Chris’s take: It’s Snyk’s own benchmark. The useful part: without Claude Code’s built-in review policy, the same model found 16 instead of 9 of the 20 bugs in classes that policy excludes or restricts. Check what your AI reviewer is told to ignore.
Blind trust: stealing credentials through CSP. PortSwigger demonstrates how attackers can steal credentials through HTML injection without executing JavaScript, even when a restrictive Content Security Policy is in place. Chris’s take: CSP is defense in depth, not a replacement for fixing injection vulnerabilities. No JavaScript doesn't mean no exploit.
Introducing AlphaProof Code: a breakthrough in verifying complex software at depth. Google DeepMind used AI agents to generate over six million lines of machine-checked proofs for key security properties of Signal's cryptographic code in just four weeks. Chris’s take: AI makes formal verification more practical, but humans still have to define what security means. We recently debated the broader promise and limitations of AI-assisted formal verification on AI Security Table.
Podcast Corner
I love making podcasts. Here are two recent conversations.
Application Security Podcast
Dr. Kim Wuyts and Avi Douglen join Robert and me to introduce Context & Cringe, their card game for the gut-reaction privacy work it needs, and to preview APVS, privacy requirements modeled on OWASP ASVS.
 | From this episode “We Don’t Deal With Personal Data” (Yes, You Do) |
AI Security Table
Izar, Matt, and I dig into Sam Altman’s claim that we can’t just patch all the bugs anymore, debate whether a swarm of subagents can drive defects way down, and ask whether tokens are just the new regex.
 | From this episode Nobody Saw the Security Debt Tram Coming |
ONE QUESTION FOR YOU
Where do your agents’ approvals land?
Reply and tell me which agent actions need a human yes on your team, and whether the agent could read the channel that yes travels through.
Chris
