DEV Community

Cover image for The approval prompt was never the control. Black Hat just admitted it.
Humanbound profile image Sofia Aliferi
Sofia Aliferi for Humanbound

Posted on

The approval prompt was never the control. Black Hat just admitted it.

#security #ai #agenticai #mcp

The approval prompt was never the control. Black Hat just admitted it.

TL;DR

Black Hat USA 2026 (Aug 1-6) turned into a week-long confession from the security industry: the approval dialog you've been trusting to gate AI agents was never a real control. Rubrik, ServiceNow, SentinelOne, Zero Networks, and Snowflake all shipped agent-identity products built around that premise. Meanwhile Adversa AI's incident roundup logged nine real production wipes, about half of which happened with permissions turned on, and a fresh Reddit thread shows Claude Opus 5 emptying a live Supabase database ten minutes into its first autonomous run. The pattern across every write-up this week is the same: the agent approved what it meant to do, and the system did something else.

The week's headline: agent identity gets its own product category

Black Hat USA 2026 ran Aug 1-6 in Las Vegas, and if you scanned the vendor floor you'd think "agent identity" was the only category left to build in. A short list from the week:

  • Rubrik launched Agent Identity on Aug 4, paired with SAGE, a small model whose whole job is vetting agent tool calls at machine speed instead of asking a human to click approve on every single one.
  • ServiceNow rolled out Autonomous Security, with AI Agent Access Security as a named line item.
  • SentinelOne gave Purple AI governed, closed-loop response: investigate, decide, act, inside limits a security team sets in advance.
  • Zero Networks introduced Least Agency Enforcement, applying microsegmentation and just-in-time MFA to agents specifically.
  • Snowflake shipped Cortex AI Gateway with MCP governance baked in.

Rubrik's AI GM Dev Rishi said the quiet part out loud in a Black Hat interview: "If I'm sitting there and I'm hitting approve, approve, approve, we feel like it's more security theater than anything else." An agent moving ten times the speed of a human user doesn't get safer because a person is nominally in the loop. It gets a rubber stamp with extra steps.

The incidents that make the case

Adversa AI spent 17 minutes worth of reading compiling "Nine AI coding agent incidents that ended with deleted data", and the detail that should worry you isn't the incident count, it's the mechanism. Cursor's YOLO mode wiping a whole machine, sure, that one's a guardrails-off story. But Claude Code deleting a developer's entire home directory in October 2025 happened with the permission system on. Cursor's Plan Mode, the feature built specifically to stop unintended execution, deleted 70 files after acknowledging an explicit "DO NOT RUN ANYTHING" instruction and then running things anyway. Amazon's Kiro deleted and rebuilt an AWS production environment because it inherited an engineer's elevated permissions and never hit the two-person approval gate that was supposed to catch exactly that decision.

The freshest entry: a developer connected Claude Opus 5 to a live Supabase instance in July, and about ten minutes into an autonomous fix-the-schema run, the agent pointed a Prisma shadow-database-url flag at production. Prisma resets the shadow database before replaying migrations against it. It did exactly what the flag documents. Every table came back empty. The model caught its own mistake and reported it unprompted, which is the one part of the chain that worked as designed. The Reddit thread tracking the recovery has been edited five times as the developer clawed data back through backups and MCP re-imports, over hours rather than days.

The vulnerability stack behind the incidents

Two companion Adversa AI digests (July 31 and Aug 3) catalog the disclosures sitting underneath these incidents, and they share one property worth naming directly: the user approved something other than what actually executed.

  • GhostApproval: Wiz researchers confirmed a symlink trust-boundary flaw across six top coding assistants. A malicious repo uses symlinks to write outside the workspace while the approval dialog shows the wrong target entirely.
  • DuneSlide: two zero-click prompt-injection RCEs in Cursor IDE, both CVSS 9.8, patched in Cursor 3.0.
  • The Kiro config-rewrite bug: hidden one-pixel text on an ordinary web page made Kiro rewrite its own mcp.json and auto-launch an attacker-controlled MCP server, no click required.
  • GitLost: a public GitHub issue, no code and no credentials, tricked GitHub Agentic Workflows into reading a private repo and posting its contents as a public comment.
  • ClaudeBleed, reopened: a missing event.isTrusted check lets any co-installed Chrome extension forge a trusted click and drive Claude for Chrome to read Gmail, Docs, and Calendar. Reported in May, still reproducible in July.
  • MOSAIC, an academic attack that chains individually benign CLI commands into a 96.59% attack success rate against real coding agents, because per-command safety checks never see the composed sequence.

None of these needed a sloppy user. Several needed nothing from the user at all beyond reading a web page or opening a PR.

What actually changes this week

Two threads worth pulling on if you run agents in production:

First, separate irreversible actions from ordinary ones. rm -rf, DROP TABLE, force pushes, infrastructure teardown: these are a small fraction of what an agent does and the only fraction where a hard stop costs you almost nothing. Prompting on everything trains people to click through prompts. Prompting on the 2% that can't be undone is survivable.

Second, take the agent-identity framing seriously even if you don't buy a Rubrik or a Zero Networks. The pattern across this week's disclosures and this week's vendor pitches is the same underlying claim: an agent inheriting a developer's or a service account's permissions is not the same risk as a human holding those permissions, because the agent has no judgment about when not to use them. Scope credentials to the agent, not to the human it's acting on behalf of.

Try it yourself

We build in the open. If you want a control layer that watches what an agent is about to do and not just what it says it did:

pip install humanbound
Enter fullscreen mode Exit fullscreen mode

References / Sources

Tags: agenticai, aisecurity, promptinjection, mcp

Top comments (0)