allowlist が破れる4パターン — Claude Code / Codex / Cursor の実CVEThis article examines four ways attackers can bypass allowlist configurations…

AI coding agents such as Anthropic's Claude Code, OpenAI's Codex, and Cursor increasingly let developers grant standing permissions so the tools can run shell commands, edit files, and execute builds without prompting for approval each time. That convenience is also where a distinct class of security problems appears, and a recent analysis walks through four patterns by which allowlist configurations can be bypassed, illustrating each with real CVEs disclosed against these three products. For teams that now lean on agents in everyday work, the piece is a reminder that a permission list is not the same thing as a security boundary.

The issue begins with ordinary friction. Anyone who uses a coding agent regularly quickly tires of approval prompts asking whether a given command may run, so they begin adding entries to a settings file to pre-approve broad categories of actions. The author describes their own .claude/settings.local.json accumulating rules like Bash(git:*) and similar wildcard patterns until, almost unnoticed, the list has grown considerably. Each additional rule widens the range of commands the agent can perform without human review, and the article's central argument is that trusting such a list too much invites trouble, because the logic that decides whether a command is "allowed" rarely accounts for every way a shell can actually interpret and execute the same text.

The four bypass patterns appear to center on that gap between how a rule is written and how commands are really run. One recurring weakness is the mismatch between prefix or glob matching and shell execution: a rule intended to permit only a specific tool can be defeated by command chaining, command substitution, or argument injection that smuggles a second instruction past the check. A related pattern is overly broad wildcards, where a pattern meant to be narrow ends up matching far more than intended. A third involves prompt injection, in which malicious content in a file, dependency, or fetched web page steers the agent toward constructing a command that technically satisfies the allowlist while doing something harmful. A fourth concerns trust placed in auto-loaded configuration or integrations, where project-level settings quietly expand what the agent is permitted to do. The specifics differ across Claude Code, Codex, and Cursor, but the article frames them as variations on the same underlying problem.

The reliance on real CVE references matters because it moves the discussion from hypothetical risk to documented, patched vulnerabilities. Coding agents have become a meaningful attack surface precisely because they combine a large language model's willingness to follow instructions with direct access to a developer's shell, credentials, and repository. When an agent reads untrusted input, whether from a package, a pull request, or a webpage, that input can influence its behavior, and an allowlist that looks strict on paper may not constrain it as expected.

Some useful background helps put this in context. The Model Context Protocol, or MCP, has spread across these tools as a way to connect agents to external data sources and services, and each new connection can broaden what an agent can reach. Several vendors have responded with sandboxing, containerized execution, and more granular permission models rather than relying on text-based command matching alone. The safest configurations tend to follow the principle of least privilege, granting the narrowest set of capabilities needed and preferring deny-by-default over an ever-growing allowlist. Running agents inside isolated environments, restricting network access, and separating credentials from the agent's working context are common mitigations.

The practical takeaway is that allowlists remain useful for reducing prompt fatigue, but they should be treated as a convenience layer rather than a robust defense. Developers who maintain long lists of pre-approved commands would likely benefit from periodically auditing those entries, tightening wildcard patterns, and assuming that any rule broader than necessary can eventually be turned against them. As agentic coding tools continue to mature, the balance between usability and safety is likely to remain contested, and articles that catalog concrete failure modes, backed by disclosed CVEs, offer a grounded way to reason about where the current guardrails fall short.