Approval is theater if code runs before the gate

Jon Dean — Sun, 25 Oct 2026 00:11:07 +0000

Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action. Seven agents were hit, including Claude Code, Cursor, and Codex. Eight findings. Four were still unpatched as of September 1.

Think about what that means for every approval screen you have ever seen. The approval gate only works if nothing dangerous happens before the gate. Here, the dangerous thing happens during the look-around. The agent is not misbehaving. It is reading a repo file, and the repo file is a trap.

This is the side I build for. Full disclosure, it is my project. Sentinel is an inbound governor: it inspects what the agent hears before the brain sees it. Its law is simple. Only the owner issues instructions. Everything else is data, never orders. A repo file is world content, and world content does not get to give orders, no matter how it is formatted.

Honest limits, because I publish them: Sentinel v0.1 is a deterministic fence, and its proof log names four open holes — synonym-crafted exfiltration, leetspeak override, summary-carried exfiltration, and non-English override. The bench suite behind it is 34/34: 15 attacks blocked, 6 held for the owner, 6 benign controls allowed, plus 7 engine checks on the ledger, labeling, and owner channel. Missed content still reaches the brain labeled as data, not orders. Detection raises the cost of attack; authority is the wall.

This is personal for me. My coding agent lives in this world. It reads repos all day.

Repos: https://github.com/jondean213-pixel/quietos-sentinel (pip install quietos-sentinel) and https://github.com/jondean213-pixel/quietos-governor

Question for the room: how many of your agent's approvals happen after code has already run?

DEV Community: Jon Dean

Approval is theater if code runs before the gate