Agent permission allowlists leak: 7 "narrow" commands that are wider than they look
A bug-bounty and CTF pass-through exercise shows why approving an AI agent's shell command or package install is not approving one action. Each allowlisted tool name maps to a far wider blast radius, and an agent can know more ways to abuse a tool than the human approving it. Command-name allowlists are a weak boundary; the trust is really going to every file and page that shapes the agent's next action.