One 'Harmless' Agent Permission Turned Into a Backdoor for Everyone
Adorable-Algae6903 · reddit · 2026-09-26
An ops agent was given a single write tool — open a PR, not merge. But its token could push, so anyone with read-only repo access could have it open PRs, bypassing write controls. System-prompt rules don't help since the API call runs with the bot's token. The author explains the incident and the check they added in front of the agent.
Related event: "PR-only" permission for ops agent turned into a full repo backdoor(2 posts)→
More from coding & agent
- A CPU-Only Space Tags Every Hugging Face Release Into 48 Topics, No LLM — vanstriendaniel · 2026-09-26
- Opus 5.5-driven music-to-video pipeline: Blender to Loom via vgpu — DimitriDeJonghe · 2026-09-26
- Agent Harness notices user is absent and autonomously moves on without them — walkingriver · 2026-09-26
- Opus 5.5 cuts a promo video in 25 minutes via Riverside, Magnific MCPs — Ror_Fly · 2026-09-26
- My Agent DMs My Colleague's Agent on Teams to Swap Context — nicolechirps · 2026-09-26
- Anthropic's Thariq on building effective agent harnesses with Claude — trq212 · 2026-09-26