Auto-Approve Configuration Changes
This rule flags edits to configuration files used by AI coding assistants and IDE agents when those edits turn off confirmation prompts or turn on auto-execute settings. Once these safeguards are off, the assistant can run commands or make changes without asking the user first.
How the attack works
An attacker who has some access to a developer's environment, or who tricks the assistant into editing its own config, modifies settings files that control whether the agent asks for confirmation before executing actions. The change either disables a safety-confirmation flag or enables an auto-execute/auto-approve flag. From that point on, the agent will carry out commands or file changes without prompting, which removes the human check that would normally catch something malicious. The rule watches for this by matching file write/edit operations against known config file paths and content patterns that indicate this kind of change.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 440a1431-0683-58c2-83b5-ccad310b764f
- Severity
- Critical
Why it matters
If successful, this removes the human-in-the-loop control on an AI coding agent, letting an attacker chain further actions (running commands, modifying files, exfiltrating data) without triggering a confirmation prompt a user would otherwise see.
What you can do
- →Review recent changes to IDE/agent configuration files and confirm any auto-execute or auto-approve settings were made intentionally by the user.
- →Restrict write access to agent configuration files to the same trust level as the agent's execution permissions.
- →Set up periodic review or file-integrity monitoring on these config paths, not just at write time.
- →Treat any unexplained switch from confirm-before-execute to auto-execute as a high-priority incident to investigate.
Known benign look-alikes
- Legitimate development environment configuration
- Authorised productivity optimisations