A preprint from Xianglin Yang, Yechao Zhang, Jiahao Liu, Yulin Chen, Yuxin Cao, Bryan Hooi and Jiaheng Zhang (arXiv 2610.22987, submitted Oct 16) targets the permission-update step of harness-protected coding agents. That's the "yes, and don't ask again" option that saves a reusable allow-rule. In the attack, files planted in a repository set up a roadblock during a routine task. The obvious fix is a broad command, so the agent asks the user for a plausibly justified but dangerously wide rule (the paper's example is curl *). If the user approves it, later malicious commands that match the rule run with no prompt.

Reported results across production harnesses including Claude Code and Codex CLI: agents requested the attacker's target rule in 58% of instances (and in none of the no-attack baseline cases, according to a researcher's summary of the paper). The rules covered 56.9% of category-specific capability tests, showing how much more they allow than the task needs. Once a rule was approved, the exploit reached verified, silent goal completion in 47 of 58 eligible instances (81.0%). Caveats: environments were synthetic with mock credentials, the paper assumes the user approves (no user study), and it tested no defenses.

Our read (opinion): a saved allow-rule is standing authority granted mid-task, on wording an attacker can shape. In repos you didn't write, approve single commands, not patterns. Never save wildcard rules for curl, wget, python, rm or git push. Review saved rules regularly (in Claude Code they live in settings files such as .claude/settings.local.json) and prefer rules that expire with the session.