Command denylists are bypassed with base64, subshells and scripts
Backslash showed Cursor's auto-run denylist let blocked commands through when encoded, wrapped in a subshell, or put in a script.
- Agents
- Cursor
- Reported
- Source checked
- Tags
- denylist, yolo-mode, shell
Symptom
You added curl to the denylist, yet the agent still fetched a URL in auto-run mode.
Cause
The denylist matched command text, not what the shell actually executes, so equivalent forms of a blocked command went through.
Fix
Don't rely on denylists. Use an allowlist of exact commands, keep approval for everything else, and enforce network and filesystem limits at the OS or container level.
# Network is the boundary, not the command text
docker run --rm -it --network none -v "$PWD":/work -w /work node:22 bash