What happened
NVD/CVE.org published CVE-2026-76072 (CVSS 7.4 High) on 2026-08-24, describing how Continue CLI's headless/auto mode permission model uses an incomplete denylist as its only defense against destructive shell commands, with Bash granted default allow access.
Why it matters
As AI coding agents are increasingly run unattended in CI pipelines and autonomous dev workflows, an incomplete denylist-based safety control is a systemic gap: a single prompt injection or agent misjudgment in headless mode can trigger irreversible destructive actions on developer or CI infrastructure with no human in the loop.
Attack vector
In headless and auto mode, Continue CLI's default policy (extensions/cli/src/permissions/defaultPolicies.ts) grants the Bash tool 'allow' permission by default, and the permission checker's denylist of destructive commands is incomplete, meaning a prompt-injected or misdirected agent can execute destructive shell commands (e.g., data deletion, exfiltration commands) without a human approval gate, since the intended safety barrier is bypassable.
Affected systems
Continue CLI (continuedev/continue), headless/auto mode configurations
Mitigation
Per the CVE.org record, apply the vendor fix/update to the Continue CLI permission model; explicitly restrict Bash tool permissions and avoid relying solely on the built-in denylist for unattended/headless deployments — enforce explicit allow-lists and sandboxing instead.