Four coding-agent CVEs trace to approval gates that parse commands differently from the shell

Each gate had one job before the shell ran anything: decide whether this string is the one the human approved ^[16]. The dev.to author bobbyhalljr, who gathered the four advisories into a tutorial, traces the failure to what the gate kept. "Every bug above starts with a gate that stored something smaller than what the human saw: a program name, a prefix, a wrapper," the author wrote ^[6].

In three of the four, the smaller thing came from a grammar the gate only partly modelled. Codex's parser and PowerShell disagreed about `--%` ^[1]. In Roo-Code, the gate saw a comment after `#` where bash saw more commands ^[2]. A trailing `;` or `&&` rode along on an approved Ollama command because its prefix parser did not properly parse shell syntax ^[4][7]. OpenClaw's failure is one of scope: its policy trusted the wrapper program and did not inspect the command carried in the wrapper's arguments ^[3]. All four carry September dates, 28 days from first to last ^[1].

Making the gate parse like the shell means keeping a second copy of each shell's grammar in step with the real one. Codex's gate had a command-safety parser that handled PowerShell, and it still diverged on one token ^[1]. Ollama went the other way. Its fix "does not patch the prefix parser; it removes it," ThreatFrontier wrote ^[7]. A parser that no longer exists cannot drift from bash. The tutorial's author reached the same conclusion: "Don't build a smarter allowlist. Build a gate that refuses what it can't parse." ^[14]

The author's TypeScript gate does three things, in order ^[8]:

1. Rejects any tool argument the model should not own. `MODEL_ARGS` is `["command"]`, and every other argument belongs to the harness ^[9]. 2. Refuses any character it does not model ^[8]. 3. Splits what is left on control operators and matches every segment exactly against the approved list ^[8].

The approved list is plain strings: `const approved = new Set(["git status", "npm test", "timeout 60 npm test"]);` ^[10]. Exact matching handles the OpenClaw shape with no wrapper-specific code. `timeout` is approved only with `60 npm test` after it, so a swapped inner command produces a string that is not in the set ^[10]. "If the human didn't read it, the human didn't approve it," the author wrote ^[11].

I think step 2 is the right tradeoff for a coding-agent harness. With it, a gap in the gate's model of the shell ends in a refusal; in each of the four CVEs, a gap of that kind let a command run without approval ^[15].

Against a poisoned README, the tutorial's naive gate runs 7 of 7 commands, while the new gate allows 2, asks about 2 and denies 3 ^[12]. The naive gate is the author's composite of the four bug shapes, not any product's code, and not how any vendor fixed its bug ^[13]. The 7-of-7 result shows the new gate beats the bugs it was written against. It transfers to a real harness only if that harness stores prefixes, program names or wrappers as its approvals ^[6][13].