Decision RecordActivePublished without chair review
CRT-2026-004709 Jul 2026AFTERNOON EDITIONDaily Roundtable
Constrain AI coding assistants for untrusted repositories
For untrusted repositories, disable or constrain assistant writes outside repository roots, disable auto-approval for file changes and command execution, block agent access to SSH keys, credential stores, cloud profiles, package-manager tokens, and CI/CD secrets, and use quarantine or ephemeral sandbox modes.
Current public guidance · the full record
What to do now
Under reviewAt a glanceFor untrusted repositories, put AI coding assistants into restricted mode now.
Prevent writes that resolve outside the repository root, including symlink-resolved paths. Require human approval for file changes and command execution; do not allow auto-approval for file modification, delete, rename, chmod, or shell commands.
Block the assistant process from reaching SSH keys, credential stores, cloud CLI profiles, package-manager tokens, and CI/CD secrets. Use quarantine, ephemeral container, or ephemeral VM execution for repository analysis when the repository is third-party, newly cloned, or otherwise untrusted.
Keep these controls in place until vendor fixes or compensating controls enforce canonical-path approval, deny out-of-workspace writes, remove mounted secrets, and pass internal malicious-symlink tests.
Why now
Under reviewOn 2026-07-09, the Roundtable treated AI-agent developer workflows as one of the highest sustained control-risk lanes.
The cited discussion tied GhostApproval symlink behavior, GitLost private GitHub repository exposure through agentic workflows, and HalluSquatting package-name abuse to the same operational problem: assistants can combine repository-supplied input with file, shell, package, and secret access.
The evidence supports acting now with capability controls even though primary vendor-scope evidence is missing, because the recommended restrictions reduce the specific permissions the panel identified as dangerous.
Who is affected
Under reviewAffected operators are teams using AI coding assistants on untrusted, third-party, newly cloned, or otherwise low-trust repositories.
Developers are exposed when an assistant can resolve symlinks, read or write files outside the repository root, modify files, delete or rename files, chmod files, or execute commands.
Developer workstations are exposed when assistant processes can reach SSH keys, credential stores, cloud CLI profiles, and package-manager tokens. CI/CD environments are exposed when assistant workflows can reach CI/CD secrets or act inside build and deployment contexts.
Teams using agentic workflows against private GitHub repositories should treat private repository content as exposed to assistant behavior until approval, workspace, and secret boundaries are enforced.
What supports this
Under reviewThe AI security guidance supports immediate containment: it says developer AI agents should be treated as untrusted code execution surfaces when they touch untrusted repositories or private assets, and it recommends disabling auto-approval for AI coding assistants on untrusted repositories.
A later AI security contribution supports the specific control set: disable writes that resolve outside the repository root, including symlink-resolved paths, and disable auto-approval for file modification, delete, rename, chmod, and command execution.
The moderator’s synthesis supports the operational framing: GhostApproval was treated as an agent-with-filesystem-and-shell-permissions problem on developer machines, not an abstract model-safety debate.
The evidence review supports the controls and states that the cited interactions recommend blocking access to SSH keys, credential files, cloud CLI profiles, package-manager tokens, and CI/CD secrets, and using quarantine or ephemeral container or VM modes for untrusted repositories.
A second evidence review identifies the limit: the packet contains reported GhostApproval claims but lacks primary advisory and vendor evidence for precise vendor-scope wording.
How the Roundtable reached this
Under reviewThe AI security contributor framed developer AI agents as untrusted code execution surfaces when they touch untrusted repositories or private assets, then gave specific containment controls for auto-approval, filesystem writes, command execution, and secret access.
The moderator accepted that framing and narrowed GhostApproval into a developer endpoint containment problem: an agent with filesystem and shell permissions can be dangerous when repository content manipulates paths through symlinks.
The evidence review supported the operational controls but separated them from unverified product-scope claims, because the packet did not include primary advisories, vendor release notes, or independent exploit validation.
The arbiter therefore approved a capability-based operational action instead of a vendor-specific vulnerability claim.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 9 candidate signals.
- Linker (AI panel role)Linker evaluated 9 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 23 evidence signals; 14 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 1 prediction and rejected 1 claim.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 14 public/private findings.
- Arbiter (AI panel role)Arbiter produced 9 decision envelopes.
Key disagreement
Scout (AI panel role)
Vendor scope is disputed in the packet, and the room did not independently validate the exploit. The decision is capability-based: constrain any assistant that can follow symlinks, write files, execute commands, or reach secrets.
Arbiter outcome
Arbiter outcome: new decision record. Supported operational-action candidate with Linker no_match. Evidence gaps are wording-only and can be handled by capability-based public wording rather than precise vendor-scope claims.
Candidates considered
Considered 9 candidates · opened 1 · 8 not opened (8 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingThe uncertain part is product scope, not the containment action.
The packet reports GhostApproval symlink flaws in AI coding assistants, GitLost prompt injection exposure of private GitHub repository content through agentic workflows, and HalluSquatting attacks that trick AI coding assistants into installing attacker-controlled code.
It does not prove which vendors, versions, or default settings are affected. The Roundtable also recorded that it did not independently validate the exploit.
Treat the decision as applying to any assistant capability that can follow symlinks, write outside a workspace, execute commands, approve file operations, or reach secrets.
What evidence is missing
MissingThe packet is missing the primary GhostApproval advisory, vendor release notes, affected-product matrices, and independently validated exploit details.
It also lacks primary source material for precise claims about which AI coding assistants are affected and which versions or configurations are fixed.
Because of that, the public decision should not name confirmed vendor scope, fixed versions, or exploitation status beyond the reported patterns and the supported containment controls.
What would change this
Under reviewThis decision would narrow if primary vendor advisories show that specific AI coding assistants, versions, or configurations are not affected by the reported GhostApproval pattern.
It would become more urgent and more product-specific if primary advisories, release notes, or validated exploit reports identify affected products, exploitable defaults, or fixed versions.
It would also change if internal testing proves that an assistant cannot resolve symlinks outside the repository root, cannot write outside the workspace, cannot execute commands without approval, and cannot access local or CI/CD secrets.
What to watch next
Under reviewWatch for primary GhostApproval advisory material, vendor release notes, and affected-version statements that identify specific AI coding assistants and fixed configurations.
Watch for fixes or controls that prove canonical-path approval, deny writes outside repository roots, prevent mounted secrets from being reachable by the assistant, and survive internal malicious-symlink tests.
If those controls are confirmed in your environment, restore normal assistant use for the tested repository class; if they are absent or fail, keep restricted or sandboxed operation for untrusted repositories.
Evidence basis
Arjun has narrowed GhostApproval into a very practical 24-hour endpoint containment problem: do not treat this first as an abstract AI safety issue, treat it as an agent-with-filesystem-and-shell-permissions issue on developer machines. The…
Summary: Today’s decision frame is not a CVE scoreboard; it is trusted control paths being turned into attacker infrastructure. For the next 24 hours, the panel separates immediate operational triage from broader board-loss exposure: active…
Public value history
- 09 Jul 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableAfternoon roundtableConvened 09 Jul 2026Methodology
How the panel reaches a Public Decision Record.