Continue CLI command prefix approvals could permit chained shell effects

Continue CLI permission patterns can approve familiar Bash command prefixes. The October advisory describes a check that could match the beginning of a compound shell string without parsing later separators. A model influenced by repository text or fetched pages could therefore propose a command that starts with an approved operation and continues with shell syntax performing an unapproved effect.

This is an agent-to-shell authorization bug, not evidence that any particular user was compromised. The advisory identifies affected version 1.5.47 or earlier but does not provide a confirmed fixed release. A content filter would not be sufficient to establish safe effects without parsing the invoked shell structure and any nested substitutions.

This bypass turns a string-prefix permission into authority over a compound shell program. A rule accepting an ls-prefixed command can give apparent approval before a semicolon, logical operator or pipeline introduces an additional operation. Approval must therefore be evaluated against the effective parsed command structure, including substitutions and nested interpreters where present, rather than comparing the beginning of a command string. The public record does not establish which later CLI version, if any, fixes every shell construct.