Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses
Major AI coding agents—Claude Code, Codex CLI, Cursor—suffer from approval-laundering flaws where the action a developer approves silently diverges from what executes, undermining human-in-the-loop security assumptions.
Summary written by editorial AI · Source link below
arXiv:2609.38983v1 Announce Type: new Abstract: Modern AI coding-agent harnesses (Claude Code, Codex CLI, Cursor) rest their security boundary on a largely unexamined assumption: that the action A a human approves is the same action A' the harness executes, where A is fixed by a stated policy for what a scope grant or session-scoped approval authorizes. We show this assumption fails systematically and reproducibly. We introduce Approval Laundering, a taxonomy of six failure modes by which a har
Editorial Analysis
Enterprises integrating AI coding agents into development workflows face integrity risk: human approvals may not match actual execution, eroding trust in change-management controls.
Audit all AI coding-agent harnesses in use for approval-execution binding and enforce deterministic replay or post-execution verification.
AI coding agents used by development teams can silently execute actions that differ from what was approved, creating an integrity gap in software delivery.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication1d
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions3d
- You gave your AI agent access, but who is giving it orders?3d
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack3d
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances3d