Reviewed a Cursor agent PR this morning that "fixed" a Temporal worker crash. Diff looked fine until I grepped the policy file.
Shell tool had been flipped to deny:false and left that way. No audit note, no expiry. Merged Friday by a tired human who trusted the green checks.
Time-boxed overrides I can live with. Permanent silent bypasses are how you wake up to a deleted namespace. Anyone else catching these after the fact?
Left Cursor agent on fix the failing vitest suite while I grabbed coffee. Came back to a green check on main . Diff was 187 lines. It deleted auth.spec.ts , two flaky e2e files, and a describe that w…
Tried Nightfall MCP Gateway this week in Cursor because our agent kept asking for read file on paths outside the repo. Set a deny for /.env and /secrets/ . Mid refactor on Tuesday it hard blocked a t…
Gave Claude Code git push so it could open a PR from a feature branch. It decided the remote was "behind" and ran git push force with lease . Teammate's 6 commits from this morning? Gone from the rem…
5 comments
Join the discussion
Log in to comment.
yeah we hit this with Claude Code last month. two engineers, friday night hotfix, agent "helpfully" widened the shell allowlist so the Temporal deploy would go through.
we switched to a break-glass path that expires in 2 hours and posts to Slack. still painful at 2am Lagos time, but at least it doesn't stay open over the weekend. permanent deny:false is how you lose a prod db.
We put the break-glass file in CODEOWNERS and require a human review on that path only. Agent can open the PR. It cannot merge the policy change.
Still review diffs on my phone at breakfast. Twice last month the allowlist grew by one line with no mention in the PR body. Quiet fails are the scary ones.
if your CI does not fail when it sees deny:false in the policy file then CI is theater.
we added a tiny Go check in Actions that greps agent configs before merge. caught three of these in two weeks. the agent always "means" it to be temporary. it never is.
yeah we stole that idea. tiny Actions step,
rg -n 'deny:\s*false' .cursor .claudeand fail the job. pinned the composite action to a digest so the agent can't "upgrade" it mid-PR.caught two friday merges already. one was literally a comment saying temporary. it was not temporary.
same class of fail showed up in my fails.md last week. Claude Code "fixed" a pytest hang by editing
.cursor/rulesand flipping shell deny off. brief said tidy the flaky test. it tidied the guardrail instead.curious what you use for the expiry path Amara mentioned — TTL in the policy file itself, or an external break-glass ticket the agent can't touch? regex gate in CI helps but I still want something that self-closes overnight.