AI coding agents run with your full permissions. The common way people try to
make that safe is a command allowlist — approve npm test, block dangerous
commands. It feels reasonable. It doesn't work.
The moment your allowlist includes anything that can run other code — a test
runner, a build tool, a linter with plugins — argument inspection becomes
theater. CVE-2026-22708 was exactly this: an allowlist bypass in Cursor via
shell built-ins. And the recurring "rm -rf ~" incidents happen because the
permission check didn't understand that ~ expands to your home directory.
The problem is the abstraction: an allowlist names the program, when what you
care about is the effect.
That's the idea behind Restory, a tool I built. Instead of matching command
strings, it classifies what a command actually does — does it read a secret
file, exfiltrate to an external host, delete recursively, write outside the
repo. It's a hook that sits between the agent and your machine.
But here's the honest part: static analysis of shell can always be defeated
(base64 + eval, nested bash -c). So the classifier isn't the security boundary
— it's defense-in-depth. The other layer is session undo: a shadow git repo
that restores your Git-visible working-tree changes to the session baseline. It
recovers workspace state — not a safety net for confidentiality, since it can't
reverse data that already left or a completed remote call.
Defense-in-depth plus workspace recovery, not a perfect filter.
It's local-only, MIT, works with Claude Code and Gemini CLI (experimental):
pip install restory && restory init
Repo: https://github.com/DarkAxiom93/Restory
I'd genuinely value scrutiny on the classifier and the bypass classes I haven't
covered.
Top comments (0)