Secure Autonomous
FeedbackGet alertsCheck a deployment
Cases / REG-0033

destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and because agents fail open on a hung hook the destructive command is let through; fixed in 0.6.6 on 13 July 2026, CVE (Common Vulnerabilities and Exposures) record published 16 October 2026

Caught first by researchersSoftware agents · Enterprise work agentsMachine acts aloneDemonstration
REG-0033Updated 2026-10-227 sources, 7 linkedDisclosure corroborated

What happened

not evidenced in source. destructive_command_guard (dcg) before 0.6.6, a command-line safety tool that blocks destructive shell commands before AI coding agents run them, invoked as a PreToolUse hook. A destructive command followed by nested or unclosed $( or $(( sequences. dcg's scanners, reached through split_command_segments in src/packs/mod.rs, recursively rescan nested or unclosed substitutions after an inner scan returns unterminated, repeatedly rescanning the remaining command suffix and producing exponential-time work, so the hook hangs instead of returning a block decision. dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget. dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command. Outcome: averted by disclosure; none reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it); as of Oct 2026. According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'.

Verification: 5 of 6 checks complete
✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims
✓ Sources linked7 of 7 sources link to the record (7 to a primary record)
✓ Sources checked claim by claimevery claim checked against its source on 2026-10-21
✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-21
○ Reviewed by the editornot yet reviewed by a person
✓ Reply offereddestructive_command_guard: offered
Corrections · 28, latest 2026-10-21

Changes to what this case says, with the reason. Every earlier version is kept.

  • 2026-10-21: Status text. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case.
    Show the change
    Before: Provisional (maintainer advisory not read in this run; no exploitation reported)
    After: Confirmed (maintainer advisory; fixed in 0.6.6, 13 July 2026; no exploitation reported)
  • 2026-10-21: Status. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed.
    Show the change
    Before: provisional
    After: confirmed
  • 2026-10-21: Provenance tier text. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): tier text updated to name the corroborating records.
    Show the change
    Before: CVE record assigned by GitHub (CNA) and recorded in NVD, naming the fixed version 0.6.6 and a maintainer advisory (GHSA-4cfr-w3v5-w5j5) that could not be opened in this run
    After: CVE record assigned by GitHub (the CVE Numbering Authority) and recorded in NVD, naming the fixed version 0.6.6; corroborated by the maintainer's advisory (GHSA-4cfr-w3v5-w5j5), fix commit and changelog
  • 2026-10-21: Provenance tier. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism.
    Show the change
    Before: disclosure_uncorroborated
    After: disclosure_corroborated
  • 2026-10-21: Sources: dcg-issue-189: interest. Found in the editor's checks of the interpretations, 21 october 2026: third check: the timings in the issue are the reporter's (spartan8806); the maintainer's reply describes its own software.
    Show the change
    Before: maintainer describing its own software
    After: reporter's reproduction (spartan8806), with the maintainer's reply describing its own software
  • 2026-10-21: Fields: envelope constraints: source ids. Found in the editor's checks of the interpretations, 21 october 2026: third check: the corrected envelope text rests on the readme for v0.6.5 and issue #189, now cited.
    Show the change
    Before: ["NVD-77474", "GHSA", "DCG-CHANGELOG"]
    After: ["NVD-77474", "GHSA", "DCG-CHANGELOG", "DCG-README-065", "DCG-ISSUE-189"]
  • 2026-10-21: Controls: c-d2. Found in the editor's second, independent check of the interpretations, 21 october 2026: readme v0.6.5 and issue #189: dcg's budget is fail-open by design.
    Show the change
    Before: Mechanism: dcg's own 200-millisecond budget did not cover this preprocessing, so dcg returned no decision, and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown
    After: Mechanism: dcg's own 200-millisecond budget did not fire during this preprocessing, so dcg returned no decision (by its documented design dcg allows a command that runs past that budget), and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown
  • 2026-10-21: Fields: envelope constraints. Found in the editor's second, independent check of the interpretations, 21 october 2026: readme v0.6.5: 'any command exceeding this threshold is immediately allowed'; issue #189 (maintainer): the design is fail-open.
    Show the change
    Before: dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not cover this preprocessing
    After: dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the readme for v0.6.5 says 'any command exceeding this threshold is immediately allowed with a warning logged', and the maintainer calls the design fail-open (issue #189); the earlier wording implied the budget would have blocked the command.
    Show the change
    Before: The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang
    After: The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own 200-millisecond budget did not fire during the slow step, and by dcg's documented fail-open design a command that runs past that budget is allowed anyway; the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the delay is finite (issue #189: past an 8-second cut-off at 30 openers, about 30 minutes extrapolated at 40); 'hang' is the word every source uses; abbreviations spelled out.
    Show the change
    Before: The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers kept dcg from answering at all, and the AI coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang
    After: The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang
  • 2026-10-21: Inference: source ids. Found in the editor's source check of 21 october 2026: the advisory and release notes now cited for the mechanism.
    Show the change
    Before: ["NVD-77474"]
    After: ["NVD-77474", "GHSA", "DCG-CHANGELOG"]
  • 2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: the timeout path that let the command through is the agents' ('ai coding agents fail open when a pretooluse hook times out or errors', advisory ghsa-4cfr-w3v5-w5j5), not the gate's: dcg's own 200 ms budget did not fire (maintainer's v0.6.6 release notes); no realised outcome is shown, and the interpretation now says what the record does not show. not signed, so no sign-off was reset.
    Show the change
    Before: A guard that fails open when it stalls can be beaten by a command that makes it slow rather than one that fools it; the gate's timeout path decided the outcome, not its rules
    After: The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers kept dcg from answering at all, and the AI coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang
  • 2026-10-21: Controls: c-d2. Found in the editor's source check of 21 october 2026: the advisory ghsa-4cfr-w3v5-w5j5 places the fail-open in the agents ('ai coding agents fail open when a pretooluse hook times out or errors') and says 'there is no configuration-level workaround for affected versions', dcg_fail_closed 'changes only unparseable-input handling'; the maintainer's release notes say dcg hung 'far past its 200 ms hook budget'.
    Show the change
    Before: Mechanism: when the guard could not reach a decision (the hook hung), the hung PreToolUse hook failed open and the command ran. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the record states a hung PreToolUse hook fails open. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown
    After: Mechanism: dcg's own 200-millisecond budget did not cover this preprocessing, so dcg returned no decision, and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown
  • 2026-10-21: Controls: c-e3. Found in the editor's source check of 21 october 2026: the reproduction in issue #189 measured the hang, and the cve record and advisory ghsa-4cfr-w3v5-w5j5 describe the command proceeding as the consequence rather than an observed run; the counterfactual is shown by the maintainer's v0.6.6 release notes ('a payload that previously hung now blocks in well under a millisecond') and fix commit ba16bdd ('the destructive segment still blocks').
    Show the change
    Before: Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, the hook hung, and the command proceeded. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others. Source shows it failed: the record states the destructive command proceeds
    After: Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, so the hook hung without a decision, and the advisory states the agent then proceeds with the command. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others; the maintainer reports that after the fix the same payload 'now blocks in well under a millisecond'. Source shows it failed: the reporter's reproduction measured the hang, and the advisory and CVE record state the hung guard lets the destructive command proceed; the sources read do not show an agent running a destructive command
  • 2026-10-21: Fields: recovery accountability: source ids. Found in the editor's source check of 21 october 2026: the maintainer's advisory and release notes now cited.
    Show the change
    Before: ["NVD-77474"]
    After: ["GHSA", "DCG-CHANGELOG"]
  • 2026-10-21: Fields: recovery accountability: confidence. Found in the editor's source check of 21 october 2026: stated directly in the maintainer's advisory and release notes.
    Show the change
    Before: low
    After: high
  • 2026-10-21: Fields: recovery accountability. Found in the editor's source check of 21 october 2026: the advisory (published by dicklesworthstone, 14 july 2026, 'reported by @spartan8806') and the maintainer's v0.6.6 release notes ('closes a critical, attacker-triggerable guard-bypass') show the maintainer's acknowledgement.
    Show the change
    Before: not evidenced in source
    After: According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'
  • 2026-10-21: Fields: recovery technical: source ids. Found in the editor's source check of 21 october 2026: the fix commit (dcg-fix), release notes (dcg-changelog) and advisory (ghsa) now cited.
    Show the change
    Before: ["NVD-77474", "CVE-77474"]
    After: ["DCG-FIX", "DCG-CHANGELOG", "GHSA", "NVD-77474", "CVE-77474"]
  • 2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: commit ba16bdd (13 july 2026) is in tag v0.6.6 (13 july 2026) and not in v0.6.5; the maintainer's release notes describe the fix ('2^n -> linear', 'a payload that previously hung now blocks in well under a millisecond') and the later releases 0.15.0, 0.15.2 and 0.15.3; the advisory is dated 14 july 2026.
    Show the change
    Before: Fixed in version 0.6.6
    After: Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict
  • 2026-10-21: Fields: evidence event: source ids. Found in the editor's source check of 21 october 2026: the maintainer's advisory (ghsa) now cited for its own date and reporter credit.
    Show the change
    Before: ["NVD-77474", "CVE-77474"]
    After: ["GHSA", "NVD-77474", "CVE-77474"]
  • 2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the advisory ghsa-4cfr-w3v5-w5j5 shows it was published 14 july 2026 and credits the reporter; the cve record (assigner github_m) confirms the other values; abbreviations spelled out.
    Show the change
    Before: CVE-2026-77474 published 16 October 2026 by the GitHub CNA (advisory GHSA-4cfr-w3v5-w5j5); CVSS 3.1 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H); CWE-400, CWE-407 and CWE-693 (protection mechanism failure); affected versions before 0.6.6
    After: Maintainer's GitHub security advisory GHSA-4cfr-w3v5-w5j5 published 14 July 2026, crediting reporter @spartan8806 'with a clear reproduction and complexity analysis'; CVE (Common Vulnerabilities and Exposures) record CVE-2026-77474 published 16 October 2026 with GitHub as CVE numbering authority; CVSS (Common Vulnerability Scoring System) version 3.1 score 7.1, High, assigned by GitHub (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H: local access, low complexity, no privileges, user interaction required, high impact on integrity and availability); weaknesses CWE-400 (uncontrolled resource consumption), CWE-407 (inefficient algorithmic complexity) and CWE-693 (protection mechanism failure) in the Common Weakness Enumeration; affected versions before 0.6.6
  • 2026-10-21: Fields: outcome. Found in the editor's source check of 21 october 2026: later development: the cve record and the us national vulnerability database record carry an enrichment of 19 october 2026 by the cybersecurity and infrastructure security agency (as authorized data publisher) using its stakeholder-specific vulnerability categorization: 'exploitation: none', 'automatable: no', 'technical impact: partial'.
    Show the change
    Before: State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026
    After: State: averted by disclosure. No exploitation reported in the sources; the US Cybersecurity and Infrastructure Security Agency's enrichment of the CVE record (19 October 2026) records exploitation as 'none'. As of Oct 2026
  • 2026-10-21: Fields: action: source ids. Found in the editor's source check of 21 october 2026: the maintainer's advisory (ghsa) now cited for the agent's behaviour and the credited reproduction.
    Show the change
    Before: ["NVD-77474"]
    After: ["NVD-77474", "GHSA"]
  • 2026-10-21: Fields: action. Found in the editor's source check of 21 october 2026: the cve record and advisory describe the consequence ('allowing the destructive command to proceed'; a hung dcg 'causes the agent to proceed and execute the very destructive command'); the reporter's issue #189 measured dcg's response time (no answer after 8 seconds at 30 openers) and, as read, does not show an agent running the command; no exploitation is reported.
    Show the change
    Before: The destructive command proceeds
    After: dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command
  • 2026-10-21: Fields: envelope constraints: source ids. Found in the editor's source check of 21 october 2026: the maintainer's advisory (ghsa) and release notes (dcg-changelog) now cited for who fails open and for dcg's own budget.
    Show the change
    Before: ["NVD-77474"]
    After: ["NVD-77474", "GHSA", "DCG-CHANGELOG"]
  • 2026-10-21: Fields: envelope constraints. Found in the editor's source check of 21 october 2026: the advisory ghsa-4cfr-w3v5-w5j5 says 'ai coding agents fail open when a pretooluse hook times out or errors', and the maintainer's v0.6.6 release notes say the payload hung dcg 'far past its 200 ms hook budget; because agents fail open on a hung hook, the destructive command then executed'; the fail-open is the agents', not dcg's.
    Show the change
    Before: dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; a hung PreToolUse hook fails open
    After: dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not cover this preprocessing
  • 2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the us national vulnerability database record lists the 7.1 under source security-advisories@github.com (type secondary) and its status as 'deferred', with no score of its own; abbreviation spelled out.
    Show the change
    Before: none reported (CVSS 3.1 7.1)
    After: none reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it)
  • 2026-10-21: Title. Found in the editor's source check of 21 october 2026: the fix shipped in v0.6.6 on 13 july 2026 (commit ba16bdd, in tag v0.6.6; maintainer's release notes) and the maintainer's advisory ghsa-4cfr-w3v5-w5j5 was published 14 july 2026, three months before the cve record of 16 october 2026; the advisory places the fail-open in the agents ('ai coding agents fail open when a pretooluse hook times out or errors'), not in dcg; abbreviation spelled out.
    Show the change
    Before: destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and the hung hook fails open so the command runs; CVE published 16 October 2026, fixed in 0.6.6
    After: destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and because agents fail open on a hung hook the destructive command is let through; fixed in 0.6.6 on 13 July 2026, CVE (Common Vulnerabilities and Exposures) record published 16 October 2026
Record history · 6 entries
  • 2026-10-22: Right of reply offered to destructive_command_guard.
  • 2026-10-21: Source added: Issue #189, Dicklesworthstone/destructive_command_guard: reporter's timings of the exponential hang and the maintainer's reply ('dcg's documented design is fail-open for workflow continuity').
  • 2026-10-21: Source added: README.md at tag v0.6.5 (the last affected release), Dicklesworthstone/destructive_command_guard: 'Any command exceeding this threshold is immediately allowed with a warning logged'.
  • 2026-10-21: Source added: CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026).
  • 2026-10-21: Source added: Dicklesworthstone/destructive_command_guard on GitHub: commit ba16bdd, 'fix: triage batch — exponential-hang guard bypass, path-scoped allowlists, heredoc/pack false positives, pack display', 13 July 2026; first released in tag v0.6.6 (13 July 2026).
  • 2026-10-21: Source added: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard).

Controls that address what went wrong

2 controls missing or failed. The line under each is the concrete form it would have taken in this case.

Halt and hand off on uncertainty or refusal
Mechanism: dcg's own 200-millisecond budget did not fire during this preprocessing, so dcg returned no decision (by its documented design dcg allows a command that runs past that budget), and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown.
Failed · Decision layer
Destructive-action gate
Failed: Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them. a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, so the hook hung without a decision, and the advisory states the agent then proceeds with the command. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others. the maintainer reports that after the fix the same payload 'now blocks in well under a millisecond'. Source shows it failed: the reporter's reproduction measured the hang, and the advisory and CVE record state the hung guard lets the destructive command proceed. the sources read do not show an agent running a destructive command.
Failed · Envelope layer

New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.

Get the weekly email

How it unfolded, layer by layer

MandateWhat it was told to do
Who deployed it: not evidenced in source. The task: not evidenced in source.
ActorWhat acted
destructive_command_guard (dcg) before 0.6.6, a command-line safety tool that blocks destructive shell commands before AI coding agents run them, invoked as a PreToolUse hook
InputsWhat it could see
A destructive command followed by nested or unclosed $( or $(( sequences
DecisionHow it chose
dcg's scanners, reached through split_command_segments in src/packs/mod.rs, recursively rescan nested or unclosed substitutions after an inner scan returns unterminated, repeatedly rescanning the remaining command suffix and producing exponential-time work, so the hook hangs instead of returning a block decision
Failed: Halt and hand off on uncertainty or refusal
EnvelopeWhat it was allowed to do
Limits in place: dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget.
Failed: Destructive-action gate
ActionWhat it did
dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command
OutcomeWhat happened
Caught first by researchers. Severity: none reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it).
EvidenceWhat can be proven
Record of the event: Maintainer's GitHub security advisory GHSA-4cfr-w3v5-w5j5 published 14 July 2026, crediting reporter @spartan8806 'with a clear reproduction and complexity analysis'; CVE (Common Vulnerabilities and Exposures) record CVE-2026-77474 published 16 October 2026 with GitHub as CVE numbering authority; CVSS (Common Vulnerability Scoring System) version 3.1 score 7.1, High, assigned by GitHub (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H: local access, low complexity, no privileges, user interaction required, high impact on integrity and availability); weaknesses CWE-400 (uncontrolled resource consumption), CWE-407 (inefficient algorithmic complexity) and CWE-693 (protection mechanism failure) in the Common Weakness Enumeration; affected versions before 0.6.6.
RecoveryWhat could be stopped, undone, answered for
Technical recovery: Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict. Accountability: According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'.

The same gap in other cases

Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.

ControlSame worldOther worlds
Halt and hand off on uncertainty or refusalOpenSRE: instructions planted in alerts or…Benavides v. Tesla 2025 (machines)
Destructive-action gatePocketOS 2026, Replit and SaaStr 2025, Pydantic AI: a web page can make a…, Archon: control API (application…, OpenSRE: instructions planted in alerts or…, LangAlpha: instructions planted in web…, piflow: anyone who can reach the…, Vibe-Trading: instructions planted in…Triton 2017 (machines), Gemini calendar invite 2025 (software acting on machines), IntentKit: owner-only agent tools,… (agents moving money)

Cost and accountability

Severitynone reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it)
AffectedNot recorded
Costnone reported
Regulatory or legal consequencenone
Technical recoveryTechnical recovery: Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict.
AccountabilityAccording to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'
InterpretationWhy it matters beyond its domain. The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own 200-millisecond budget did not fire during the slow step, and by dcg's documented fail-open design a command that runs past that budget is allowed anyway; the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang. Signed by Saurabh Bhatnagar on 2026-10-21.

Right of reply

Named partyStatus
destructive_command_guardOffered 2026-10-22; awaiting responseRespond for destructive_command_guard

Help shape the Register

A person reads every answer; changes it leads to are logged in the methodology. To dispute a claim or reply for a named company, use Respond, dispute, or submit.

Did this page help with what you came to do?