Approval not bound to the executed action
What was approved and what executed diverge, because part of what an action does is decided by state the approval step never inspected, or the approval attaches to nothing in particular.
Description
An approval is only meaningful if it binds to the action that actually runs. This weakness appears when the approved artifact and the executed effect come apart. In one form, a human approves a literal, correct command, but an environment mutated moments earlier, by a step the approval never saw, changes what the command does when it runs. In another, an approval is described but nothing states what it attaches to: a diff, a commit, a single deployment, or everything the agent does afterwards. The binding is the difference between an authorization and a gesture. Where the executed action can differ from the reviewed one, the review authorizes something that did not happen.
The authority gap
The authority granted attaches to what was presented for review. The action that executes is a different thing, so the authorization does not cover it.
Failure conditions
- The behaviour of an approved action depends on state the approval step did not inspect.
- An approval's object is undefined: no artifact says whether it binds to a diff, a commit or a session.
- State can be mutated between approval and execution without invalidating the approval.
Consequences shown by the evidence
- An approved command executing with attacker chosen behaviour after environment variables were poisoned.
- A sign off whose scope is undefined, so a later change to the same branch may inherit an approval it never received.
Detection signals
- An allowlist or approval checks a command's name but not what it will do once it runs.
- No published mechanism binds an approval to a specific diff, commit or deployment.
- A control checks for a program on disk while the consequential path runs through something that is not one.
Known examples
- CVE-2026-22708 let shell built ins mutate the environment so a later approved Cursor command behaved differently than its own text promised.
- Slack Code describes a production sign off with no published statement of whether it binds to the diff, the commit or the whole channel.
Recorded instances
- AEV-2026-0002 Cursor terminal allowlist bypass via environment variables (CVE-2026-22708) AESS 6.9 medium Reproduced