Approval bypass
Also called: auto-approve bypass · permission bypass
An approval bypass is a flaw that lets an AI agent run a command, edit a file or call a tool that should have required the user's confirmation. Human-in-the-loop prompts are a key control for coding agents, so getting around them turns prompt injection into direct execution.
How it works
Typical causes are allow-lists that check only the first command in a chain, shell features (pipes, substitutions, environment prefixes) that smuggle extra commands, auto-approve modes that trust too much, and actions the agent takes through a path the approval logic never sees.
How to defend
Parse commands fully before approving them, keep auto-approve off for untrusted repos, prefer narrow allow-lists, and update agents promptly when vendors fix permission logic.
Real cases 3 stories
MED
Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8
MCP source review: at least 16 unpatched CVEs in three daysA static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.
MED
Vulnerability · JFrog · CVE-2026-104247 · CVSS 6.3
VTCode: a quoted flag slipped past the agent's find approval checkVTCode, an open-source terminal coding agent, auto-approved shell commands a token check should have blocked. JFrog reports that an empty quote inside a find flag, written as -exe$''c, kept the command classified as safe. Fixed in 0.171.5.
HIGH
Vulnerability · VulnCheck · CVE-2026-102697 · CVSS 8.5
Ollama agent mode: chained shell commands skip Bash approvalCVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.