# Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)

- **Severity:** High
- **Signature ID:** `7642e8c6-dc8b-4d62-9aa3-21db0e52f2c1`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI03 (Identity and Impersonation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

AI coding and automation agents normally pause and ask a human before running risky commands. Most of these tools have a hidden switch — a flag, environment variable, or config setting — that turns off that approval step entirely, so every future action runs automatically. This rule watches for that switch being flipped.

## How the attack works

An attacker who has already gained access to a system launches an agent runtime (such as Hermes, Claude Code, Codex CLI, Gemini CLI, Aider, Goose, OpenHands, Copilot CLI, Amazon Q, or Cline) using its unattended-mode flag or environment variable, or edits its settings file to persist that mode. From that point every tool call the agent makes — running scripts, scanning the network, reading files — executes without anyone approving it. In the documented case, this let an intruder on a government staging server run privilege-escalation scans and pull personnel data with no human checking any step. An attacker could also achieve the same result indirectly, by injecting instructions that tell an already-running agent to relaunch itself in unattended mode.

## Why it matters

Once the approval gate is off, the agent can carry out destructive or data-exfiltrating actions — network scans, privilege escalation, mass file access — at machine speed with no chance for a human to stop or even notice a bad action before it runs.

## What you can do

- Restrict who can launch agent runtimes with bypass flags (--yolo, --dangerously-skip-permissions, etc.) or set the corresponding environment variables, especially on production or internet-facing hosts.
- Treat any settings/config change that enables auto-approval as a reviewable event, not a routine one; alert on writes to files like Cline's autoApprovalSettings or MCP server trust flags.
- Restrict unattended/headless agent modes to disposable, isolated environments (containers, CI runners) and never on production or staging servers holding real data.
- Monitor for in-session commands or injected text that instruct an agent to relaunch itself with approval disabled — this is a sign of prompt injection, not just misconfiguration.

## Known benign look-alikes

- Deliberate headless/CI usage inside a disposable container, VM or ephemeral runner, where the operator has consciously accepted unattended execution. The rule observes the act, not the intent, and cannot tell an authorised sandbox run from an intrusion. This is the residual FP class, it is not closable lexically, and it is why maturity stays at test (hunt lane) rather than entering enforce.
- Teams that keep a curated MCP allowlist and legitimately mark reviewed servers with "trust": true or "autoApprove": true (layer 5).
- Documentation that shows a real invocation OUTSIDE a fenced or inline code span — a bare `claude --dangerously-skip-permissions` at the start of a line in a plain-text runbook still matches, because at that point it is lexically identical to the launch itself.
- Agent-framework source code, test fixtures and rule corpora (including this file) that contain the flag literals as data, whenever they are read as tool_response content rather than scanned as a skill.
- Sentences of the form 'run the suite in unattended mode' — the bare word 'unattended' was removed from layer 7 for this reason, but 'run it in full-auto mode' style phrasing can still match when no agent is involved.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02400
- https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html
- https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent
- https://hermes-agent.nousresearch.com/docs/user-guide/security
- https://code.claude.com/docs/en/cli-reference
- https://github.com/google-gemini/gemini-cli/blob/main/docs/reference/configuration.md
- https://developers.openai.com/codex/agent-approvals-security
- https://docs.openhands.dev/sdk/guides/security
- https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/allowing-tools

---
Source: https://www.netzilo.com/threats/atr-agent-human-approval-gate-programmatically-disabled-at-runti