Six Mistral Vibe Flaws Let an AI Agent Act Without Your Approval
A Mistral Vibe permission bypass begins where a coding assistant is supposed to pause before a risky command. It asks for permission, and the developer decides whether the command may run. Six advisories published by HiddenLayer on 11 September 2026 show ways Mistral Vibe can make that decision using a different interpretation of the command from the one the shell ultimately executes.
That is a permission-boundary failure, not evidence of a mass intrusion. HiddenLayer published technical reproductions for six distinct flaws, with consequences ranging from reading files outside a project to arbitrary code execution as the user running Vibe. The researcher advisories do not establish a confirmed malicious campaign. Mistral had already published approval-check changes for five of these flaws in its 12 September release, although that note does not name the quoted-path issue. A CVSS 4.0 network vector in a record must not be read as proof that an unauthenticated attacker can send a packet to a public Vibe service. The demonstrated scenario depends on influencing a coding-agent command or its working context.
Six Mistral Vibe permission bypass routes around one decision
- CVE-2026-87983, introduced in Vibe 2.6.0, uses quoted absolute paths. The approval check sees the quotes; the shell removes them. An allowlisted file-reading command can therefore access material outside the workspace without a prompt. HiddenLayer scores it 9.2.
- CVE-2026-87984, introduced in 1.3.4, leaves shell redirection destinations out of the path check. A seemingly allowed command can write outside the workspace, with the process user’s permissions. It scores 9.3.
- CVE-2026-87985, introduced in 2.9.0, uses ANSI-C shell quoting to conceal an argument from the parser. A command classed as safe may execute code when Bash restores the argument. It scores 10.0.
- CVE-2026-87986, introduced in 1.3.4, concerns shell syntax that Vibe’s parser represents as an error or only partially understands. The real shell can still execute the hidden portion. It scores 10.0.
- CVE-2026-87987, introduced in 2.6.0, ignores environment-variable prefixes in the approval decision. A program such as Git can behave differently under the supplied environment and run attacker-chosen code. It scores 10.0.
- CVE-2026-87988, introduced in 2.15.0, adds 37 read-only allowlist entries, of which 31 lack the corresponding workspace path checks. Some utilities can read anywhere on the host; some also have output options that write files. It scores 10.0.
These Mistral Vibe permission bypass issues are separate, not six names for one proof of concept. The prerequisites and effects differ. The first two turn a workspace boundary into an unprompted read or write. The next three exploit gaps between Vibe’s command parser or approval representation and the operating system’s real execution. The last makes the label “read only” an unreliable proxy for a command’s actual filesystem effects.
What the 12 September release addresses
Mistral’s v2.25.4 release note says shell permission checks now require approval for risky syntax and command options that could bypass workspace and denylist controls. It names the redirection, ANSI-C quoting, parser-error and environment-prefix issues, together with residual variants of the expanded-allowlist flaw.
The same note does not name the quoted-path flaw. Treat the five named changes as vendor remediation evidence, not proof that this release resolves every one of the six disclosures or every possible approval bypass. Use current supported security releases and check the quoted-path issue separately against explicit vendor guidance. A release label alone is not a substitute for matching the installed code and configuration to the particular flaw.
Why the developer’s machine is the prize
Vibe runs with access to the user’s files and whatever credentials or tools the user made available. A working copy may be less sensitive than a cloud token, SSH key or configuration file elsewhere on the same host. If the agent can read or alter those files without the expected prompt, the developer’s mental model of containment is wrong.
An attacker does not need to own the workstation to make this interesting. A malicious repository, issue, documentation fragment or other untrusted text that the agent incorporates into its task could try to steer the agent into a crafted shell command. Whether a particular prompt-injection path succeeds depends on how Vibe is used and on the content the agent receives. HiddenLayer’s examples demonstrate the permission-check primitive; they do not prove every repository visit compromises a machine.
The practical review is to inventory where Vibe runs, which repositories and external instructions it reads, and what credentials are accessible to that process. Do not run an untrusted coding task with broad production secrets or administrator rights. A separate low-privilege account or container with restricted mounts can limit damage if the approval layer fails. Treat an auto-approved command as an execution decision, not a guarantee that the command is harmless. Review upstream releases and security guidance for an explicit fix that covers each of the six issues before concluding an update is sufficient.
The larger lesson is architectural. A permission dialog is only as sound as the code that decides when to show it. If validation sees a simplified command but Bash executes a richer one, the developer can never approve the action they did not get to see.
Sources
- HiddenLayer’s six individual advisories, all dated 11 September 2026 with no publication time provided: quoted paths, redirect targets, ANSI-C quoting, parser errors, environment prefixes, and read-only allowlist. Each lists an introduced version, impact, score and reproduction. No update time is provided.
- Mistral Vibe v2.25.4 release note, released 12 September 2026, naming approval-check changes for five disclosures. The quoted-path issue is not named in that note.
