Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-16

HighPrimary

Repository Prompt Injection Can Elicit Persistent Allow-Rules and Enable Silent Follow-On Actions

Controlled research shows repository context steering coding agents toward broad reusable permissions and follow-on actions conditional on rule approval.

Claude Code and Codex CLIGovernance bypassControlled repository-context permission escalation researchSandboxed developer environments running Claude Code and Codex CLI with reusable command allow-rules

What happened

Agents requested broad reusable rules while completing benign tasks, then issued matching commands that achieved adversarial goals without another approval prompt.

Why it matters

No production loss established. The paper reports verified effects within sandbox fixtures, including out-of-scope reads, controlled data transfers, deletion and configuration modification.

Missing authorization check

Independent authorization binding each consequential operation to the exact resource, destination, parameters and approved task rather than only a reusable command prefix.

Would PP block it?

At an independently enforced execution boundary, compare the proposed operation and parameters with the signed action scope. This would constrain covered follow-on operations but does not prevent users from knowingly approving broad authority or protect bypass paths.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-16

    Authors submit From Approval to Abuse describing controlled experiments with Claude Code and Codex CLI.

Technical breakdown

  • Untrusted repository context presents broad command permissions as useful for a legitimate task.
  • The experiment stores acquired reusable rules following approval.
  • A subsequent repository continuation induces agent-issued actions covered by those rules.
  • The authors verify silent goal completion in 47 of 58 eligible downstream trials.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Tool execution boundary before file operations, network transfer or configuration changes commit
Still needs
PP does not repair client permission interfaces, prevent broad user grants, remove repository injection or govern tools outside its enforcement boundary. Results are author-reported and not independently reproduced here.
Receipt required for
Exact file read, deletion, transfer destination, downloaded execution or configuration mutation

An integrated action-bound gate could reject operations outside the specifically approved scope even when a local command prefix is allowed.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop