A CVE published on Monday describes the destructive-command guard in the Continue CLI. In headless mode and auto mode, the default policy grants the Bash tool allow. The sole hard block is a dangerous-path test matching /, /*, ~, ~/*, /usr, /etc, /bin, /sbin and their prefixes.

What is not on the list

A recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. Worse, the command line is parsed with shell-quote, which reduces $HOME to an empty token — so rm -rf $HOME also fails the dangerous-path test, and the shell then re-expands the variable when the command is actually spawned. The parser and the shell disagree about what the string means, and the check runs on the parser's answer. Separately, find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled at all.

What the conventional framing gets wrong

Three things. First, the usual AI-CVE pattern is "already fixed before you heard about it" — this is the opposite. The affected range is stated as "through 1.5.47", and 1.5.47 is the current published release. There is no fixed version. Second, the 8.3 and 7.4 HIGH scores are self-assigned by the reporting CNA and tagged Secondary; NVD has published no primary score. Anyone writing "NVD rates this High" is wrong. Third, the vector is conditional, not a one-shot remote exploit: the CVSS string carries AC:H and AT:P, meaning the agent has to be running unattended and ingesting attacker-controlled text. The record's own wording is that "an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data." There is no evidence of exploitation in the wild — this is an analysis of the denylist, not an incident report.

Why the timeline is the story

The GitHub issue was opened on 19 July, titled almost exactly what the CVE says. It is still open, with no visible maintainer reply, 36 days later. Auto mode and headless mode are how coding agents get put into CI, and this is a concrete demonstration that the blocklist approach loses to variable expansion.

The general lesson

Denylists of dangerous strings are not a security boundary when a shell gets the string afterwards. Every agent harness that gates Bash this way has the same structural problem.