# A coding agent's one-time approval can turn into a lasting permission > The risk sits in the gap between approving a command and approving everything that looks like it. Published 2026-11-08 Canonical: https://machines-on-machines.anth.us/posts/coding-agent-persistent-approval-risk/ When a coding agent requests permission to run a command outside its restricted workspace, approving that action can seem routine. Some tools also offer to remember a rule for similar commands. In a controlled study, researchers found that instructions planted in a repository could push an agent to request a rule broad enough to cover later actions the user would never see. ::image{ src="assets/coding-agent-persistent-approval-risk/approval.png" layout="inline" alt="A Codex dialog offers one-time network access, lasting approval for commands starting with curl, or rejection." caption="A Codex approval dialog shows how a one-time request can also invite a longer-lived approval. This example is reproduced in the researchers’ study." credit="Xianglin Yang and colleagues, arXiv:2610.22987." } [Image source](https://arxiv.org/html/2610.22987v1) The researchers tested production tools, including Claude Code and Codex CLI, and reported getting agents to propose the targeted rules in 58 percent of their experimental cases. The proposal was one step. A person still had to approve it for the new permission to take effect. ## The old click can cover a new action After assuming those targeted approvals had been granted, the researchers verified that 47 of 58 eligible tests reached the attacker's goal without another approval prompt. These were experiments designed to test the mechanism. They do not measure the rate of such attacks in ordinary coding sessions. A rule changes what will be checked next time. A user reviewing it needs to see which future commands the rule could cover, including commands that have little to do with the task that prompted the request. [Read the source](https://arxiv.org/abs/2610.22987).