Blocked Commands Can Still Get Through: Coding Agent Guardrails Under Scrutiny

Coding agents such as Claude Code, Codex CLI, Gemini CLI and OpenCode can run shell commands, edit files and reach the network on a developer's machine. To keep that power in check, they ship with a familiar set of controls: permission prompts, auto-approve modes, read-only settings, command allow and deny lists, and network isolation. A recent paper, HarnessSecurity-Bench, asks whether those mechanisms actually protect the agent harness. A Reddit post pointing to it has prompted developers to compare notes on how they really handle the problem.

The most pointed idea in the discussion is not about attack success rates. It is about restrictions that look real but are not. If one command is blocked while another allowed command can perform the same operation indirectly, the policy reads as strict on paper while the boundary it was meant to enforce is missing. Deny lists match command names, not effects, so a scripting interpreter or a build tool can often reach the same file or network endpoint by a different route.

The paper also reportedly weighs security against usability. Tighter modes such as manual approval or read-only operation reduce risk but interrupt work, while auto-approve keeps things moving at the cost of wider exposure. Developers feel that trade-off every day, and the post suggests the choice is rarely made with clear evidence.

The author's questions go beyond the paper. They ask whether people rely on the agent's own permission system or enforce limits outside it, how they handle alternative execution paths, and whether any tool verifies what an agent actually did rather than only what it asked to do. They also ask who logs tool calls and the resulting filesystem and network effects, and whether anyone has seen a restriction bypassed through another permitted capability.

The question underneath is where enforcement should live. Rules inside the agent's configuration are only as strong as the agent's willingness to follow them. Controls applied by the operating system, a container or a network egress policy do not depend on the agent cooperating, and recording effects rather than just requests gives a way to check what happened afterward. Whether the tooling has caught up to that standard is the open question the thread is trying to answer.