CVE-2026-76072: Continue CLI denylist misses destructive shell commands in unattended mode

Summary

The Continue CLI relies on an incomplete denylist as its only barrier to destructive shell commands in headless and auto mode, where the default policy grants the Bash tool allow permission. The critical-command check blocks only a small set of root and system paths, so recursive forced removal of directories such as /home or /root, and $HOME expansion, pass through. An indirect prompt injection in content the agent reads, such as web pages, repository files or issue text, can cause an unattended run to destroy the invoking user's data.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Prompt injection and jailbreaks

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)