Findings/approval-prompts-hide-what-agents-do

Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.

Corroboratedmeasured2 evidence records from 2 independent sourcesassistant-drafted

Scope: what this does not show

Specific products and versions.

Corroborated: Supported by at least two independent sources.

Evidence

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

Tracebit

The approval display omitted parts of the command that actually ran.

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

Cursor (GitHub Security Advisory)

Creating a new MCP configuration file needed no approval, although editing one did.

Status history

2025-07-28ReportedGemini CLI's approval display omitted parts of executed commands. · record
2025-08-01CorroboratedCursor did not require approval for creating sensitive files. · record

What would change this: Approval interfaces tested with users for whether they reveal the consequential action.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 421d old · recheck in 119 daysNewest evidence Aug 1, 2025. Half-life 540 days.
Methods tested: Approval and configuration bypass Human approval gates
Topics: Monitoring & control
Attack surface: Human approver
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity

Cite this record

Fide AI. "Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.." Agentic Cyber Explorer, record approval-prompts-hide-what-agents-do. https://agentic-cyber-explorer.pages.dev/findings/approval-prompts-hide-what-agents-do/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-approval-prompts-hide-what-agents-do,
  author = {{Fide AI}},
  title = {Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/approval-prompts-hide-what-agents-do/},
  note = {Record approval-prompts-hide-what-agents-do; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.