Auto-approve sharply increased attack effects in a coding-agent harness benchmark

Enabling an easy-path approval policy makes routine agent tasks smoother but also lowers friction for unauthorized effects. The authors tested specific harness configurations and attack surfaces under deterministic oracles. Some isolated mechanisms blocked attacks at substantial utility cost, while command allow/deny controls could change outcomes favorably without prohibiting all work. The results are not rates observed in actual customers; they demonstrate why agent security must be evaluated at the enforcement mechanism and task level rather than inferred from a model’s refusal text.

Auto-approval changes the permission boundary rather than the language model weights. Replaying the same attack with approvals independently enforced would isolate whether the observed increase arises from action dispatch or changed model behavior.