Research & models Oct 20, 2026

Trend · preprints submitted October 16

Agents elicit overly broad approvals; it's not peer-reviewed

Two preprints report that coding agents can be attacked through user approvals and poisoned repositories; "From Approval to Abuse" finds agents eliciting overly broad allow rules in 58% of its experiments. An allow rule is what a user's one-time approval becomes: later actions that match it run without asking again. "From Approval to Abuse" tests on platforms including Claude Code and Codex CLI. Once an agent held allow rules, they covered 56.9% of the paper's capability-classification test cases. This is a different measure from the 58% (arXiv 2610.22987). "Trojan Horse" automatically plants malicious content in repositories. The authors report a success rate above 60%. The authors also built a test set of 384 poisoned repositories and evaluated 4 agent harnesses and 12 models. The authors say commercial agents can't block the attacks either (arXiv 2610.23109). Our reading of the two abstracts: once an approval turns into a general allow rule, later actions are no longer asked about one by one. Whether narrowing the scope of approvals would stop the attacks isn't tested in the abstracts. We have read only the two abstracts, and neither paper has been peer-reviewed. The numbers are the authors' self-reports from environments they built, and the abstracts don't say whether Claude Code or Codex CLI has been patched.