Why command allowlists don't protect your AI coding agent

DarkAxiom93 — Sat, 05 Sep 2026 10:01:01 +0000

AI coding agents run with your full permissions. The common way people try to
make that safe is a command allowlist — approve npm test, block dangerous
commands. It feels reasonable. It doesn't work.

The moment your allowlist includes anything that can run other code — a test
runner, a build tool, a linter with plugins — argument inspection becomes
theater. CVE-2026-22708 was exactly this: an allowlist bypass in Cursor via
shell built-ins. And the recurring "rm -rf ~" incidents happen because the
permission check didn't understand that ~ expands to your home directory.

The problem is the abstraction: an allowlist names the program, when what you
care about is the effect.

That's the idea behind Restory, a tool I built. Instead of matching command
strings, it classifies what a command actually does — does it read a secret
file, exfiltrate to an external host, delete recursively, write outside the
repo. It's a hook that sits between the agent and your machine.

But here's the honest part: static analysis of shell can always be defeated
(base64 + eval, nested bash -c). So the classifier isn't the security boundary
— it's defense-in-depth. The other layer is session undo: a shadow git repo
that restores your Git-visible working-tree changes to the session baseline. It
recovers workspace state — not a safety net for confidentiality, since it can't
reverse data that already left or a completed remote call.

Defense-in-depth plus workspace recovery, not a perfect filter.

It's local-only, MIT, works with Claude Code and Gemini CLI (experimental):
pip install restory && restory init

Repo: https://github.com/DarkAxiom93/Restory
I'd genuinely value scrutiny on the classifier and the bypass classes I haven't
covered.

DEV Community: DarkAxiom93

Why command allowlists don't protect your AI coding agent