---
title: 'From Approval to Abuse': a poisoned repo can steer Claude Code or Codex CLI into asking you for a broad allow-rule like 'curl *'; once approved, attacks finished silently in 47 of 58 cases | ctxsec
url: https://ctxsec.com/items/arxiv-allow-rule-privilege-escalation-coding-agents
description: ""
status: "research (arXiv preprint 2610.22987, Oct 16; not peer reviewed)"
published: 2026-10-20
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/arxiv-allow-rule-privilege-escalation-coding-agents.md)

research (arXiv preprint 2610.22987, Oct 16; not peer reviewed)

2026-10-20

### 'From Approval to Abuse': a poisoned repo can steer Claude Code or Codex CLI into asking you for a broad allow-rule like 'curl *'; once approved, attacks finished silently in 47 of 58 cases

A preprint from Xianglin Yang, Yechao Zhang, Jiahao Liu, Yulin Chen, Yuxin Cao, Bryan Hooi and Jiaheng Zhang (arXiv 2610.22987, submitted Oct 16) targets the **permission-update step** of harness-protected coding agents. That's the "yes, and don't ask again" option that saves a reusable allow-rule. In the attack, files planted in a repository set up a roadblock during a routine task. The obvious fix is a broad command, so the agent asks the user for a plausibly justified but dangerously wide rule (the paper's example is `curl *`). If the user approves it, later malicious commands that match the rule run with no prompt.

Reported results across production harnesses including Claude Code and Codex CLI: agents requested the attacker's target rule in **58%** of instances (and in none of the no-attack baseline cases, according to a researcher's summary of the paper). The rules covered **56.9%** of category-specific capability tests, showing how much more they allow than the task needs. Once a rule was approved, the exploit reached verified, silent goal completion in **47 of 58** eligible instances (**81.0%**). Caveats: environments were synthetic with mock credentials, the paper assumes the user approves (no user study), and it tested no defenses.

**Our read (opinion):** a saved allow-rule is standing authority granted mid-task, on wording an attacker can shape. In repos you didn't write, approve single commands, not patterns. Never save wildcard rules for `curl`, `wget`, `python`, `rm` or `git push`. Review saved rules regularly (in Claude Code they live in settings files such as `.claude/settings.local.json`) and prefer rules that expire with the session.

Sources: [arXiv 2610.22987: From Approval to Abuse](https://arxiv.org/abs/2610.22987) · [Karthik Bhaskar (X) summary, Oct 20](https://x.com/kbhaskar_95/status/2112518967734476983)