const {P,H2,Callout,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/AI-SECURITY" date="2026-09-14" title="A confirm prompt is not a confirm gate" lede="HiddenLayer filed six bugs in Mistral Vibe’s command-permission layer. Four at CVSS 10. The permission broker let commands through without a jailbreak."/>
<P>Vibe is a CLI coding agent. The interesting surface is the module that decides whether a shell command runs without asking. CVE-2026-87983 through 87988 sit there: encoding tricks, wrapper binaries, working-directory games, policy that looks at the string the model emitted instead of the process that will actually start.</P>
<P>We will not list the bypasses. The pattern is enough. If your “permission” check is a regex on the command line, the attacker writes a different command line. If confirm is a TTY prompt the agent can skip, confirm is optional. Optional is not a gate.</P>
<H2>Map it to the four</H2>
<Ul items={[
'Allowlist: the runnable set was “shell,” not a named inventory.',
'Schema: arguments were a string, not a parsed argv the broker owns.',
'Sandbox: once permission returned yes, the process was the user.',
'Confirm: four of the six bugs made the prompt never appear. Silent yes.'
]}/>
<Callout>A UI that says “Vibe wants to run a command” is documentation. The gate is: the broker starts a specific binary with a specific argv, or it does not. See <a href="post-four-gates.html">four gates</a>.</Callout>
<H2>How we test, without a circus</H2>
<P>On an owned agent product we ask: can any path from model text to process start skip the human? Encoding, aliases, relative paths, policy files in the repo. We stop at the broker. If the broker holds, the finding is “prompt is messy.” If the broker is a string match, the finding is “this is not an agent product.”</P>
<P>Same as GitSpawn: the incident is the missing schema between “the assistant suggested” and “execve.”</P>
<Related items={[
['post-four-gates.html','Four gates: allowlist, schema, sandbox, confirm'],
['post-gitspawn.html','Git status is a tool call'],
['post-skill.html','A router for reverse-engineering agents']
]}/>
</>;
}
window.Article=Article;
mountPost();