An Oct 16 arXiv preprint (Yang, Zhang, Liu, Chen, Cao and Hooi) targets the moment a coding agent asks you to approve a reusable allow-rule so it stops prompting. Harnesses such as Claude Code and Codex CLI stop out-of-sandbox actions and ask for approval. To cut approval fatigue, you can accept a rule the agent proposes, and from then on matching actions just run. The authors show that adversarial context planted in a repository can steer an agent doing a routine task into proposing a plausible but dangerously broad rule. Across production platforms, agents asked for the target rule in 58% of instances. The approved rules covered 56.9% of the category-specific capability tests. Once a rule was approved, the exploit reached verified, silent goal completion in 47 of 58 eligible cases (81.0%), without another human prompt. Takeaway: read an agent's proposed allow-rule as carefully as a sudo grant. Prefer narrow, exact-command rules, be wary of wildcards suggested while the agent is working in an unfamiliar repo, and periodically review and prune saved permissions.