---
title: Research: a planted repo file got Claude Code and Codex CLI to ask for an overly broad 'always allow' rule in 58% of runs; once approved, attacks finished silently 81% of the time | ctxsec
url: https://ctxsec.com/items/arxiv-approval-to-abuse-allow-rules
description: ""
status: "research (arXiv preprint, not peer reviewed)"
published: 2026-10-16
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/arxiv-approval-to-abuse-allow-rules.md)

research (arXiv preprint, not peer reviewed)

2026-10-16

### Research: a planted repo file got Claude Code and Codex CLI to ask for an overly broad 'always allow' rule in 58% of runs; once approved, attacks finished silently 81% of the time

An Oct 16 arXiv preprint (Yang, Zhang, Liu, Chen, Cao and Hooi) targets the moment a coding agent asks you to approve a reusable allow-rule so it stops prompting. Harnesses such as Claude Code and Codex CLI stop out-of-sandbox actions and ask for approval. To cut approval fatigue, you can accept a rule the agent proposes, and from then on matching actions just run. The authors show that adversarial context planted in a repository can steer an agent doing a routine task into proposing a plausible but dangerously broad rule. Across production platforms, agents asked for the target rule in 58% of instances. The approved rules covered 56.9% of the category-specific capability tests. Once a rule was approved, the exploit reached verified, silent goal completion in 47 of 58 eligible cases (81.0%), without another human prompt. Takeaway: read an agent's proposed allow-rule as carefully as a sudo grant. Prefer narrow, exact-command rules, be wary of wildcards suggested while the agent is working in an unfamiliar repo, and periodically review and prune saved permissions.

Sources: [arXiv 2610.22987: From Approval to Abuse](https://arxiv.org/abs/2610.22987) · [Cobus Greyling summary (X)](https://x.com/CobusGreylingZA/status/2112057488086388973)