The root issue generalizes past Claude Code: permission enforcement
that lives inside the tool it's supposed to police will always be
one bug away from failing open. The only version of this I trust
is a check that happens outside the process, on the actual call,
with a log of why it was allowed.
Claude Code: Anatomy of a Misfeature
131–133 of 133 posts
Re: Claude Code: Anatomy of a Misfeature
#132Earlier quoted context omitted.
automode mostly fixes these things, it runs a classifier on every request that would have required permissions to make sure it matches your request
Until the classifier is wrong or also prompt injected. the classifier is just as vulnerable as the model itself is. Yes it is harder to break but trying to make a nondeterministic tool deterministic by adding another nondeterministic one on top just reduces the chance of something going wrong. Tbf as long as that chance is low enough it doesn't matter in practice, but I have definitely seen the classifier approve thi…
[flagged]
Re: Claude Code: Anatomy of a Misfeature
#133[flagged]