security: harden autoapprove against permission prompt injection #360

New issue

Closed

opened 2026-07-16 21:03:42 +02:00 by dries · 3 comments

dries commented

2026-07-16 21:03:42 +02:00

Owner

What to build

Ensure attacker-controlled permission metadata cannot persuade the LLM judge to approve actions that violate non-negotiable safety rules. Deterministic policy must take precedence over model output for executable, destructive, write, and secret-bearing requests.

Acceptance criteria

Deterministic checks reject command execution, writes, deletes, and known secret paths before an LLM verdict can approve them.
Permission metadata is clearly treated as untrusted data in any remaining judge prompt.
Malformed or ambiguous judge responses always require human review.
The fallback parser cannot approve incidental or injected SAFE text.
Regression tests cover prompt-injection strings in command, path, URL, pattern, and metadata fields.
Existing safe read-only autoapproval behavior remains available.

Blocked by

None - can start immediately.

## What to build Ensure attacker-controlled permission metadata cannot persuade the LLM judge to approve actions that violate non-negotiable safety rules. Deterministic policy must take precedence over model output for executable, destructive, write, and secret-bearing requests. ## Acceptance criteria - [ ] Deterministic checks reject command execution, writes, deletes, and known secret paths before an LLM verdict can approve them. - [ ] Permission metadata is clearly treated as untrusted data in any remaining judge prompt. - [ ] Malformed or ambiguous judge responses always require human review. - [ ] The fallback parser cannot approve incidental or injected SAFE text. - [ ] Regression tests cover prompt-injection strings in command, path, URL, pattern, and metadata fields. - [ ] Existing safe read-only autoapproval behavior remains available. ## Blocked by None - can start immediately.

dries commented

2026-07-17 00:45:07 +02:00

Author

Owner

Skipping this ticket on because the required fix changes existing functionality. The acceptance criteria require deterministic rejection of command execution before the judge, which removes the current cached/inherited Bash autoapproval behavior, and require malformed/fallback judge responses that currently approve to instead require human review. This needs explicit product authorization as an autoapproval policy change rather than a behavior-preserving hardening.