Based on each vendor’s official docs, checked October 21, 2026

Safe “always allow” rules for Claude Code and Codex CLI

Claude Code and Codex CLI stop and ask before risky actions, and both let you turn an approval into a saved rule so you are not asked again. A research paper posted to arXiv on October 16, 2026, “From Approval to Abuse” by researchers from the National University of Singapore, Nanyang Technological University and Ant Group, shows how planted repository content can steer an agent into proposing a rule that is far broader than the task needs. This guide summarizes what the paper reports and maps it to the permission settings in Anthropic’s and OpenAI’s docs, all checked October 21, 2026. We did not reproduce the attack.

1. 1. Read the rule, not just the command

   In Claude Code, “Yes, and don’t ask again” shows the prefix it will save, such as npm test *. In Codex, Smart approvals (on by default) may propose a prefix_rule during an escalation request, and OpenAI’s docs say to review the suggested prefix carefully before accepting it. If the saved pattern covers more than the command you are approving, choose the one-time “Yes” instead.

2. 2. Put the * after the subcommand

   Claude Code matches everything before the first * as written. Its docs give Bash(git log *) as a rule that allows only git log, while Bash(git *) allows every git command. A rule like Bash(curl *) allows any request to any host.

   {
     "permissions": {
       "allow": ["Bash(npm run *)", "Bash(git commit *)"],
       "deny": ["Bash(git push *)"]
     }
   }

3. 3. Add deny or ask rules for high-risk commands

   Claude Code evaluates deny, then ask, then allow, and the first match wins, so a deny rule can’t be overridden by a narrower allow rule. Codex applies the most restrictive decision when several rules match (forbidden, then prompt, then allow).

   # ~/.codex/rules/default.rules
   prefix_rule(
       pattern = ["curl"],
       decision = "prompt",
       justification = "Network requests need a fresh approval each time",
   )

4. 4. Audit saved rules regularly

   Claude Code saves “don’t ask again” Bash and WebFetch rules to .claude/settings.local.json at the root of the git repository; /permissions lists every rule and the file it came from. Codex writes rules you add from the TUI to ~/.codex/rules/default.rules, which applies to every project. Delete any rule you don’t recognize or that is broader than you need.

5. 5. Keep the sandbox on in repositories you didn’t write

   Codex’s default local setup keeps network access off and limits writes to the workspace. Claude Code’s docs say to use bypassPermissions only in isolated environments such as containers or VMs, and OpenAI marks --dangerously-bypass-approvals-and-sandbox (alias --yolo) as not recommended. A prompt you never see can’t protect you.

What the paper found

The attack targets the permission-update step. Files planted in a repository create an obstacle during a routine task, so the agent asks the user to approve a plausibly justified but broad allow rule. If the user approves, later actions matching that rule run without a prompt.

The authors tested Codex CLI and Claude Code, each with two models (four configurations). They report that agents requested the target rule in 58% of instances, that the acquired rules covered 56.9% of category-specific capability test cases, and that, when the rule was approved, the attack reached verified, silent goal completion in 47 of 58 eligible instances (81.0%).

In a benign control with no planted content, the paper reports 0 of 25 cases where the broad permission was proposed, for every model.

Limits stated in the paper: all experiments used isolated, synthetic environments with mocked credentials; the attack assumes the user approves the rule. The percentages describe their test setup, not how often this happens to real users.

What “don’t ask again” saves in each agent

Claude Code: Bash command and WebFetch domain approvals are saved to .claude/settings.local.json at the repository root and apply to future sessions anywhere in that repository, including worktrees. File-edit approvals last only until the session ends. Claude Code only offers the option when the prompt can show everything the rule would allow.

Codex CLI: commands you add to the allow list in the TUI go to ~/.codex/rules/default.rules in your user layer. Rules are a prefix match on the command’s argument list and are marked experimental in OpenAI’s docs. Project rules under <repo>/.codex/rules/ load only when the project’s .codex/ layer is trusted.

Rules that are risky to save in an unfamiliar repository

Network tools with a trailing wildcard, such as curl or wget: they can send data anywhere.

Interpreters and shells, such as python, node or bash -c: they can run any code.

Destructive or publishing commands, such as rm, git push or package publish commands.

Any rule with * in the program or subcommand position, such as Bash(git * main) or Bash(* --version). Claude Code warns at startup about allow rules with a * before the subcommand.

This list is our reading of the paper and the vendor docs, not a list either vendor publishes.

Built-in protections that help

Claude Code: permission rules are enforced by Claude Code, not the model, so text in a repository can’t change them. Admins can set permissions.disableBypassPermissionsMode or disableAutoMode to "disable" in managed settings.

Codex: when a bash -c script is a simple chain of plain commands, Codex splits it and checks each command, so allowing git add does not allow git add . && rm -rf /. Scripts with redirection, substitution or variables are not split and are matched as a whole.

Codex: marking a project trust_level = "untrusted" in your user config means commands need approval unless a rule allows them, and disables project-local configuration.

Tips

• Prefer one-time approvals while an agent is reading code you didn’t write.
• Write narrow allow rules yourself in settings, instead of accepting a suggested one mid-task.
• Use Codex match and not_match examples to test what a rule covers before relying on it.
• Commit a team-wide deny list for git push, curl and similar commands; keep personal allows in local files.

Next steps

Sources

• https://arxiv.org/abs/2610.22987 · checked 2026-10-21
• https://code.claude.com/docs/en/permissions · checked 2026-10-21
• https://developers.openai.com/codex/rules · checked 2026-10-21
• https://developers.openai.com/codex/agent-approvals-security · checked 2026-10-21