One 'Harmless' Agent Permission Turned Into a Backdoor for Everyone
Adorable-Algae6903 · reddit · 2026-09-26
An ops agent was given a single write tool — open a PR, not merge. But its token could push, so anyone with read-only repo access could have it open PRs, bypassing write controls. System-prompt rules don't help since the API call runs with the bot's token. The author explains the incident and the check they added in front of the agent.
Related event: "PR-only" permission for ops agent turned into a full repo backdoor(2 posts)→
More from coding & agent
- The decade of agents: simulate real customers to test your agent before launch — EXM7777 · 2026-11-11
- FluentCRM MCP Server lets you manage marketing automation from Cursor or Claude — modelcontextprotocol · 2026-11-11
- Databricks' revised Genie agent tells CEO Ali Ghodsi the unvarnished truth — TechCrunch AI · 2026-11-11
- Elvis Saravia: agents will subsume traditional software — and can even cut code bloat — omarsar0 · 2026-11-11
- Every launches Everycut, an agent-native Mac video editor where every control is an agent tool — every · 2026-11-11
- Anthropic's Fable 5.2 built a professional video editor overnight, unsupervised — every · 2026-11-11