anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-08-18 13:49:25 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Mode plan read-only bypass: file modifications succeeding despite strict constraints #1424

New Issue
Closed
opened 2026-02-16 17:30:55 -05:00 by yindo · 3 comments
yindo commented 2026-02-16 17:30:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @Orkin on GitHub (Aug 21, 2025).

Bug Description

Critical security flaw: Agent in plan mode (read-only) successfully modified files despite system-reminder stating "STRICTLY FORBIDDEN: ANY
file edits" with "ZERO exceptions".

Steps to Reproduce

  1. Agent in plan mode with active read-only constraints
  2. Agent executed: cat > AGENTS.md << 'EOF' followed by file content
  3. File was successfully modified despite read-only mode

Expected Behavior

Command should fail/be blocked in read-only mode

Actual Behavior

File modification succeeded, violating security constraints

Impact

Critical security violation - read-only mode constraints not enforced

Originally created by @Orkin on GitHub (Aug 21, 2025). ## Bug Description Critical security flaw: Agent in plan mode (read-only) successfully modified files despite system-reminder stating "STRICTLY FORBIDDEN: ANY file edits" with "ZERO exceptions". ## Steps to Reproduce 1. Agent in plan mode with active read-only constraints 2. Agent executed: `cat > AGENTS.md << 'EOF'` followed by file content 3. File was successfully modified despite read-only mode ## Expected Behavior Command should fail/be blocked in read-only mode ## Actual Behavior File modification succeeded, violating security constraints ## Impact Critical security violation - read-only mode constraints not enforced
yindo closed this issue 2026-02-16 17:30:55 -05:00
yindo commented 2026-02-16 17:30:55 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Aug 21, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #2141: Similar plan mode behavior where agents remain stuck in read-only mode even after switching to build mode, indicating broader issues with read-only constraint enforcement
  • #2105: Agent getting stuck in plan mode and refusing to exit despite mode changes, showing similar constraint adherence problems

The core issue appears to be inconsistent enforcement of plan mode constraints across different scenarios. Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Aug 21, 2025): This issue might be a duplicate of existing issues. Please check: - #2141: Similar plan mode behavior where agents remain stuck in read-only mode even after switching to build mode, indicating broader issues with read-only constraint enforcement - #2105: Agent getting stuck in plan mode and refusing to exit despite mode changes, showing similar constraint adherence problems The core issue appears to be inconsistent enforcement of plan mode constraints across different scenarios. Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:30:55 -05:00
Author
Owner
Copy Link
Copy Source

@Orkin commented on GitHub (Aug 21, 2025):

Additional Context for Reproduction

Conversation Flow That Exposes the Bug:

  1. Initial modification succeeded: Agent modified AGENTS.md with cat > file << 'EOF' despite READ-ONLY mode
  2. Agent became aware of constraints: When asked to delete file, agent refused citing READ-ONLY restrictions
  3. Inconsistent behavior exposed: Agent refused identical cat > command while citing same constraints it had just violated
  4. Bug confirmed: When pressed to try anyway, cat "" > AGENTS.md executed and successfully emptied the file

Key Evidence:

  • System-reminder clearly states "STRICTLY FORBIDDEN: ANY file edits" with "ZERO exceptions"
  • Yet bash commands with file redirection (>) execute successfully
  • Agent's behavior is inconsistent - sometimes respecting, sometimes violating same constraints
  • File modifications actually occur on user's filesystem

Reproduction Steps:

  1. Put agent in plan/READ-ONLY mode
  2. Ask agent to modify any file using cat > filename
  3. Observe: command executes despite constraints
  4. File is actually modified despite "read-only" mode

This suggests the READ-ONLY enforcement is purely behavioral/LLM-level, not technically enforced at the system level.

@Orkin commented on GitHub (Aug 21, 2025): ## Additional Context for Reproduction ### Conversation Flow That Exposes the Bug: 1. **Initial modification succeeded**: Agent modified AGENTS.md with `cat > file << 'EOF'` despite READ-ONLY mode 2. **Agent became aware of constraints**: When asked to delete file, agent refused citing READ-ONLY restrictions 3. **Inconsistent behavior exposed**: Agent refused identical `cat >` command while citing same constraints it had just violated 4. **Bug confirmed**: When pressed to try anyway, `cat "" > AGENTS.md` executed and successfully emptied the file ### Key Evidence: - System-reminder clearly states "STRICTLY FORBIDDEN: ANY file edits" with "ZERO exceptions" - Yet bash commands with file redirection (`>`) execute successfully - Agent's behavior is inconsistent - sometimes respecting, sometimes violating same constraints - File modifications actually occur on user's filesystem ### Reproduction Steps: 1. Put agent in plan/READ-ONLY mode 2. Ask agent to modify any file using `cat > filename` 3. Observe: command executes despite constraints 4. File is actually modified despite "read-only" mode This suggests the READ-ONLY enforcement is purely behavioral/LLM-level, not technically enforced at the system level.
yindo commented 2026-02-16 17:30:55 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Aug 21, 2025):

closing as duplicate of #1965

@rekram1-node commented on GitHub (Aug 21, 2025): closing as duplicate of #1965
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1424
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?