Your AI agent acts with its own permissions, not the user's — one PR tool became a backdoor
Adorable-Algae6903 · reddit · 2026-09-26
An engineer explains how a seemingly safe ops agent (open-PR-only permission) became a backdoor allowing read-only users to open PRs, because the agent acted with its own bot token. Key lessons: authorization can't live in the prompt, user identity must come from the session (Slack/SSO) not a tool argument, and no API answer means stop. Fix: verify the requester's push permission with GitHub before any write.
Related event: "PR-only" permission for ops agent turned into a full repo backdoor(2 posts)→
More from coding & agent
- Perplexity CEO shows agent building browser-playable 3D zombie shooter in hours with zero 3D assets — AravSrinivas · 2026-11-11
- The complete harness engineering roadmap: how OpenAI shipped ~1M lines with zero hand-written code — blaizedsouza · 2026-11-11
- Micius-Flash: 27B Multimodal Model for Hardware and Semiconductor Agents — zhiman-ai · 2026-11-11
- Viral 'the harness is the machine' thread touts unverified Claude Fable/Mythos 5.2 9-equation architecture — blaizedsouza · 2026-11-11
- Compaction creates a new failure mode for coding agents: critical bug details can vanish mid-fix — blaizedsouza · 2026-11-11
- What 40+ coding-agent harnesses do between your prompt and the model, dissected — blaizedsouza · 2026-11-11