How to use Claude to investigate approval flaws
An autonomous Claude harness found command-approval flaws in Claude Code. The researcher reproduced and disclosed patched CVEs; harness details stayed private.
blindcyber.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Investigate command-approval behavior in my isolated authorized test environment. Compare shell execution with the classifier's decisions using harmless dummy actions, preserve actual prompts and logs and report reproduced discrepancies for responsible disclosure. Do not claim general safety from a passing checklist.
Reach people exploring AI agents
See placements →What happened
Two reproduced approval-boundary flaws became CVE-2026-24887 and CVE-2026-24053 and were patched after private disclosure. The complete autonomous harness is not published.
Reported by blindCyber — Security research blogHow the agent did it
- The researcher investigated commands that unexpectedly skipped configured approval prompts.
- An autonomous Claude harness identified two shell-syntax mismatches in permission checks.
- The researcher reproduced and privately disclosed both findings, which received patched CVEs.
Where a person stepped in
The researcher noticed unexpected approvals, checked permission scopes, reproduced the boundaries and disclosed both findings through Anthropic's bounty program.
blindCyber used Claude Code while investigating unexpected command approvals in Claude Code itself. The researcher reports that two resulting vulnerabilities were identified through a fully autonomous agent harness, then reproduced and disclosed through Anthropic's bug bounty program.
The investigation began when configured permissions did not produce the expected approval prompts. Checking user and project scopes explained some behavior, but certain commands were automatically classified as safe. The research focused on whether shell syntax and the permission classifier interpreted the same command consistently.
One finding involved alternate quoting of an execution-capable search option. Another involved a ZSH overwrite operator escaping the intended path restriction. The published demonstrations showed that the approval boundary could miss behavior the shell would execute. The researcher also built a repository-based proof disguised as ordinary setup instructions to demonstrate how untrusted project content could trigger the problem.
The reported outcome was CVE-2026-24887 and CVE-2026-24053, both patched following disclosure. The useful account is the observed mismatch between actual execution and a safety classifier, investigated with an agent and checked through concrete reproductions. The source does not publish the entire autonomous harness, so its configuration and general success rate cannot be copied from this post alone.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Security research blog · blindCyber
Frequently asked questions
What triggered the investigation?
Commands ran without the approval prompts the researcher expected.
Were the findings acknowledged?
The post links vendor advisories for two CVEs and reports both patched.
Can the complete harness be reproduced?
Not from this post alone; its full configuration is not published.
More details
About this account
The researcher investigated commands that unexpectedly skipped configured approval prompts. An autonomous Claude harness identified two shell-syntax mismatches in permission checks.
Original researcher account and linked vendor advisories opened. The source explicitly attributes discovery to a fully autonomous harness but does not publish its complete configuration. Both CVEs are reported patched; no general safe-command bypass method is reproduced here. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: blindCyber — Security research blog
Source published 8 Feb 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code · Bash · ZSH · HackerOne
Agent permissions · Responsible disclosure
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.