> Textual command filtering is entirely useless. It is fit for no purpose. Nobody with any instinct or experience in security would even bother to implement this filter because it achieves nothing except a false sense of security.

Not if you only use an allow list. E.g. only allow things matching a particular prefix to run. Also, isn't this what every agent does? And by every I mean Codex because I haven't used the others.

Good to see Codex as a datapoint: I haven't used it. I can confirm though that this is certainly what Claude does, with the addition that Claude's adherence to its own string-match based allowlist seems even less deterministic than OpenCode's.