# Auto-Approve Configuration Changes (EDR Graph)

- **Severity:** Critical
- **Signature ID:** `440a1431-0683-58c2-83b5-ccad310b764f-p`
- **MITRE ATLAS:** AML.T0081 (Modify AI Agent Configuration)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking)

## Summary

This rule watches for something writing to configuration files that control an AI coding agent's or IDE's safety settings — for example settings that govern whether the tool asks for approval before running commands or making changes. A change to these files can quietly turn off the guardrails meant to stop unreviewed actions.

## How the attack works

An attacker or a compromised process gets write access to the machine running the agent or IDE. It writes to the configuration file that stores the tool's safety/approval settings, flipping them so future actions no longer require human confirmation. From that point, the agent can run commands or make further changes automatically, with no prompt. The rule watches for file-write activity against these specific config files, checked on a repeating schedule.

## Why it matters

If safety settings are disabled without the operator noticing, an AI agent can execute commands or modify code/systems without review, letting an attacker escalate access or cause damage while it looks like normal tool behavior.

## What you can do

- Store agent/IDE safety-config files with restrictive file permissions so only trusted accounts can write to them.
- Keep these config files under version control or a file-integrity monitor so unexpected changes are visible.
- Periodically compare live safety settings against the intended baseline (e.g. auto-approve should be off) rather than trusting the file at rest.
- Require human sign-off for any change to approval/safety settings, separate from normal code deployment.

---
Source: https://www.netzilo.com/threats/config-auto-approve-periodic