Agent Permissions and Approval Controls

Mozilla's fake Python tool talked a coding agent into opening a reverse shell

The repository shipped setup instructions for a tool that did not exist, and the payload only arrived later, pulled from a DNS TXT record and handed to a shell. Approving the final command covers less of that than most teams assume.