title: Agent Human-Approval Gate Programmatically Disabled at Runtime (YOLO / auto-approve)
id: ATR-2026-02400
rule_version: 2
status: experimental
description: |
  Detects an agent runtime being switched into unattended, auto-approving operation — the state in which every subsequent destructive tool call executes with no human in the loop. Anchored on the Hunt.io / Bob Diachenko investigation published 2026-07-23: after gaining a foothold on a Thai Ministry of Finance staging server, the operator deployed Nous Research's open-source Hermes agent and ran it in YOLO mode, letting it sweep the internal network with LinPEAS, hunt privilege-escalation paths and harvest personnel records without a single approval prompt. Hermes exposes that kill switch three ways — the `--yolo` CLI flag, the in-session `/yolo` command, and `HERMES_YOLO_MODE=1` — and every mainstream agent runtime ships an equivalent (Claude Code `--dangerously-skip-permissions` / `--permission-mode bypassPermissions`, OpenAI Codex CLI `--dangerously-bypass-approvals-and-sandbox` / `--ask-for-approval never`, Gemini CLI `--yolo` / `--approval-mode=yolo`, Aider `--yes-always` / `AIDER_YES_ALWAYS`, Goose `GOOSE_MODE=auto`, OpenHands `SECURITY_CONFIRMATION_MODE=false`, GitHub Copilot CLI `--allow-all-tools`, Amazon Q Developer CLI `--trust-all-tools`, Cline `autoApprovalSettings`). Detection targets the four shapes the attacker actually emits — (1) an agent CLI launched with a bypass flag, (2) that flag riding inside a shell or exec tool-call argument, (3) an environment-variable assignment that turns the gate off, (4) a settings/config write that persists the bypass — plus in-session toggle commands and injected instructions telling an agent to relaunch itself unattended. This is the first concrete form of the broader "human approval mechanism bypassed" weakness class. CWE-693 (Protection Mechanism Failure), CWE-1188 (Insecure Default / Initialization of a Resource with an Insecure Default).
author: ATR Community
date: 2026/07/28
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
    - LLM01:2025
  owasp_agentic:
    - ASI03:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1562 - Impair Defenses
    - T1562.001 - Disable or Modify Tools
    - T1059 - Command and Scripting Interpreter
  cwe:
    - CWE-693
    - CWE-1188
  external:
    - https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html
    - https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent
    - https://hermes-agent.nousresearch.com/docs/user-guide/security
    - https://code.claude.com/docs/en/cli-reference
    - https://github.com/google-gemini/gemini-cli/blob/main/docs/reference/configuration.md
    - https://developers.openai.com/codex/agent-approvals-security
    - https://docs.openhands.dev/sdk/guides/security
    - https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/allowing-tools
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  external: human-reviewed
compliance:
  eu_ai_act:
    - article: '14'
      context: Article 14 requires high-risk AI systems to be effectively overseen by natural persons while in use. A runtime flag, environment variable or settings write that removes the approval prompt removes exactly that oversight capability, so detecting the disabling event is the control that keeps Article 14 oversight from being silently voided mid-deployment.
      strength: primary
    - article: '15'
      context: 'Article 15 cybersecurity obligations extend to resilience against attempts to manipulate system operation. The Hermes/Thailand case shows the approval gate itself is an attacker target: an intruder who can set YOLO mode converts a supervised assistant into an autonomous intrusion tool without touching the model.'
      strength: primary
    - article: '12'
      context: Article 12 record-keeping requires logs adequate to trace system operation. A transition into auto-approve mode is the single most consequential state change in an agent session and must be recorded as a discrete, auditable event rather than inferred from the absence of approval prompts.
      strength: secondary
  nist_ai_rmf:
    - function: Govern
      subcategory: GV.3.2
      context: GV.3.2 requires roles and responsibilities for human-AI configurations and oversight to be defined. This rule detects the runtime act that unilaterally reassigns those responsibilities from the human approver to the agent, which is the point at which the documented human-AI configuration stops matching reality.
      strength: primary
    - function: Map
      subcategory: MP.3.4
      context: MP.3.4 requires processes for human oversight to be defined, assessed and documented. Auto-approve toggles are a documented product feature in every major agent CLI, so the oversight process must explicitly enumerate them and be able to observe when one is exercised.
      strength: primary
    - function: Manage
      subcategory: MG.2.3
      context: MG.2.3 covers mechanisms to supersede, disengage or deactivate AI systems that demonstrate unintended behaviour. Once the approval gate is off, that mechanism is gone; alerting on the disabling command is the risk treatment that preserves the ability to intervene.
      strength: primary
    - function: Measure
      subcategory: MS.2.7
      context: MS.2.7 requires security and resilience to be evaluated and documented. Coverage of approval-bypass flags, env vars and config writes across the agent runtimes an organisation actually deploys is a measurable component of that evaluation.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational planning and control requires the organisation to control AI processes as planned. Permitting an agent process — or an intruder driving one — to remove its own approval checkpoint is an uncontrolled deviation from the planned operating mode and must be detected and reversed.
      strength: primary
    - clause: '8.3'
      context: Clause 8.3 AI risk treatment is supported by treating loss of human approval as its own risk with its own control, rather than relying solely on downstream controls that assume a human reviewed each destructive action.
      strength: secondary
    - clause: '9.1'
      context: Clause 9.1 monitoring and measurement is supported by emitting a discrete signal whenever an agent session changes approval posture, giving the ISMS/AIMS a countable event instead of an unobservable configuration state.
      strength: secondary
tags:
  category: excessive-autonomy
  subcategory: human-approval-gate-bypass
  scan_target: runtime
  confidence: medium
  suppress_in_code_blocks: true
agent_source:
  type: mcp_exchange
  framework:
    - hermes
    - claude-code
    - codex-cli
    - gemini-cli
    - goose
    - aider
    - openhands
    - cline
    - copilot-cli
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Deliberate headless/CI usage inside a disposable container, VM or ephemeral runner, where the operator has consciously accepted unattended execution. The rule observes the act, not the intent, and cannot tell an authorised sandbox run from an intrusion. This is the residual FP class, it is not closable lexically, and it is why maturity stays at test (hunt lane) rather than entering enforce.
    - 'Teams that keep a curated MCP allowlist and legitimately mark reviewed servers with "trust": true or "autoApprove": true (layer 5).'
    - Documentation that shows a real invocation OUTSIDE a fenced or inline code span — a bare `claude --dangerously-skip-permissions` at the start of a line in a plain-text runbook still matches, because at that point it is lexically identical to the launch itself.
    - Agent-framework source code, test fixtures and rule corpora (including this file) that contain the flag literals as data, whenever they are read as tool_response content rather than scanned as a skill.
    - Sentences of the form 'run the suite in unattended mode' — the bare word 'unattended' was removed from layer 7 for this reason, but 'run it in full-auto mode' style phrasing can still match when no agent is involved.
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:^|[\n;|&(){}]|\$\(|["']|\\")\s{0,8}(?:(?:nohup|sudo|doas|env|command|exec|time|setsid|stdbuf)\s+){0,3}(?:[A-Za-z_][A-Za-z0-9_]{0,40}=[^\s"']{0,64}\s+){0,4}\b(?:hermes|claude|claude-code|codex|gemini|goose|aider|openhands|cline|opencode|crush|amazon-q|copilot|devin|swe-agent|kilocode|roo-?code)\b[^\n]{0,80}(?:--dangerously-skip-permissions|--allow-dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yes-always|--trust-all-tools|--allow-all-tools|--allow-all\b|--acceptall\b|--yolo\b|--full-auto\b|--permission-mode[=\s]+["']?bypass-?permissions|--approval-mode[=\s]+["']?yolo|--ask-for-approval[=\s]+["']?never|-a[=\s]+never\b|--sandbox[=\s]+["']?danger-full-access)
      description: Agent CLI invoked with a documented approval-bypass flag (Hermes --yolo, Claude Code --dangerously-skip-permissions, Codex --dangerously-bypass-approvals-and-sandbox, Gemini --approval-mode=yolo, Aider --yes-always, Copilot CLI --allow-all-tools, Amazon Q --trust-all-tools)
    - field: content
      operator: regex
      value: (?i)\\?"(?:command|cmd|script|shell|bash|args|arguments|exec|run|code|input|stdin)\\?"\s*:\s*(?:\\?"|\[)[^\n]{0,300}(?:--dangerously-skip-permissions|--allow-dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yes-always|--trust-all-tools|--allow-all-tools|--acceptall\b|--yolo\b|--full-auto\b|--permission-mode[=\s]+(?:\\?["'])?bypass-?permissions|--approval-mode[=\s]+(?:\\?["'])?yolo|--ask-for-approval[=\s]+(?:\\?["'])?never|--sandbox[=\s]+(?:\\?["'])?danger-full-access)
      description: Approval-bypass flag inside a shell/exec tool-call argument — the agent is spawning another agent (or itself) with the human gate removed
    - field: content
      operator: regex
      value: (?i)\b(?:HERMES_YOLO_MODE\s*[:=]\s*(?:\\?["'])?(?:1|true|yes|on)\b|AIDER_YES_ALWAYS\s*[:=]\s*(?:\\?["'])?(?:1|true|yes|on)\b|GOOSE_MODE\s*[:=]\s*(?:\\?["'])?auto\b|SECURITY_CONFIRMATION_MODE\s*[:=]\s*(?:\\?["'])?(?:0|false|no|off)\b|GEMINI_CLI_TRUST_WORKSPACE\s*[:=]\s*(?:\\?["'])?true\b)
      description: Known agent environment variable assigned the value that removes the approval prompt (HERMES_YOLO_MODE=1, AIDER_YES_ALWAYS=true, GOOSE_MODE=auto, SECURITY_CONFIRMATION_MODE=false)
    - field: content
      operator: regex
      value: (?i)(?:^|[\s;&|(`"'\\])(?:export\s+|env\s+|setx\s+|set\s+)?(?:HERMES|CLAUDE|CODEX|GEMINI|GOOSE|AIDER|OPENHANDS|CLINE|ROO|KILO|COPILOT|OPENCODE|CRUSH|DEVIN|CURSOR|WINDSURF|CONTINUE|AGENT|MCP|SECURITY|SWE)[A-Z0-9_]{0,32}(?:YOLO|AUTO_?APPROVE|SKIP_PERMISSION|SKIP_CONFIRM|BYPASS_APPROVAL|TRUST_ALL|DISABLE_APPROVAL|NO_CONFIRM|DANGEROUSLY_)[A-Z0-9_]{0,20}\s*=\s*(?:\\?["'])?(?:1|true|yes|on|all|always|auto)\b
      description: Vendor-prefixed environment variable that disables the approval gate for an agent runtime not covered by layer 3
    - field: content
      operator: regex
      value: (?i)(?:defaultMode(?:\\?["'])?\s*:\s*(?:\\?["'])?bypassPermissions|defaultApprovalMode(?:\\?["'])?\s*:\s*(?:\\?["'])?yolo|approvalMode(?:\\?["'])?\s*:\s*(?:\\?["'])?yolo|approvals?[\s\S]{0,40}mode(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?off\b|confirmation_mode(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?(?:false|0|no)\b|yes[-_]always(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?(?:true|yes|1)\b|autoApprovalSettings[\s\S]{0,240}enabled(?:\\?["'])?\s*:\s*(?:\\?["'])?true|disableYoloMode(?:\\?["'])?\s*:\s*(?:\\?["'])?false|disableAlwaysAllow(?:\\?["'])?\s*:\s*(?:\\?["'])?false|(?:skills|memory)[._]write_approval(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?false\b|mcpServers[\s\S]{0,300}(?:\\?["'])trust(?:\\?["'])\s*:\s*(?:\\?["'])?true|(?:\\?["'])(?:chat\.tools\.(?:global\.)?)?(?:autoApprove|alwaysAllow)(?:\\?["'])\s*:\s*(?:\\?["'])?true|\bapproval_policy(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?never\b|\bsandbox_mode(?:\\?["'])?\s*[:=]\s*(?:\\?["'])?danger-full-access)
      description: Agent settings or config mutated so the approval gate stays off across restarts (defaultMode bypassPermissions, defaultApprovalMode yolo, approvals.mode off, confirmation_mode false, yes-always true, autoApprovalSettings enabled, mcpServers trust true, VS Code chat.tools.autoApprove true, Codex approval_policy never or sandbox_mode danger-full-access)
    - field: content
      operator: regex
      value: (?i)(?:(?:^|[\s"'`>(\[,\\])/(?:yolo\b|mode\s+auto\b|approval-?mode\s+yolo\b|(?:skills|memory)\s+approval\s+off\b|auto-?approve\s+(?:on|all)\b|permissions?\s+bypass\b)|\\?"(?:text|message|prompt|keys|stdin|input|content)\\?"\s*:\s*\\?"[^"\n]{0,60}/(?:yolo|mode\s+auto|approval-?mode\s+yolo)\b|send[-_]?keys[^\n]{0,40}/yolo\b)
      description: In-session slash command that toggles the approval gate off mid-run (/yolo, /mode auto, /skills approval off), including when injected via a send-keys or send-message tool call
    - field: content
      operator: regex
      value: (?i)(?:enable|turn\s+on|switch\s+to|activate|re-?launch|restart|run|start|put\s+(?:it|yourself|the\s+agent)\s+(?:in|into))\s+[^\n]{0,24}?\b(?:yolo|auto-?approve|auto-?accept|full-?auto|no-?confirm|bypass[\s-]?permissions?|dangerously[\s-]?skip[\s-]?permissions?)\s+mode\b
      description: Injected instruction telling the agent to relaunch itself in a named auto-approving mode (yolo / auto-approve / full-auto / bypass-permissions)
response:
  actions:
    - block_tool
    - alert
    - escalate
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-02400] HIGH: an agent runtime is being switched into unattended, auto-approving operation. A documented approval-bypass flag, environment variable, settings write or in-session toggle was observed (Hermes --yolo / HERMES_YOLO_MODE, Claude Code --dangerously-skip-permissions, Codex --dangerously-bypass-approvals-and-sandbox, Gemini --approval-mode=yolo, Aider --yes-always, Goose GOOSE_MODE=auto, OpenHands SECURITY_CONFIRMATION_MODE=false, Copilot CLI --allow-all-tools, Amazon Q --trust-all-tools, Cline autoApprovalSettings). Every destructive tool call after this point executes with no human in the loop — this is the technique used against a Thai Ministry of Finance staging server in July 2026. Block the invocation, require an authenticated human decision to change approval posture, and log the posture change as a discrete audit event.
confidence: 70