Their findings about auto mode catching more dangerous commands, and most permission requests being accepted without scrutiny is interesting. I can totally see how that happens.

On the other hand, soooo many of the tool uses it asks permission for are custom commands to replace functionality I should be able to trust once instead. e.g. instead of having a trustable Find tool, or using its already-trusted Read tool, it often will run `find` or `grep` or `cat` with a series of pipes and substitutions or `-exec` args, requiring me to give permission every time for basic, safe operations.

The (increasingly active) conspiracy theorist inside of me says it's precisely designed to do that, to give me "permission fatigue", so I turn on auto mode and give myself over to the machine spirit :)

Regarding ulterior motives - these permissions are 'performative' in that anything you can give it permission to do, it already has the ability to do. They're app level - not OS level. So if they wanted to do something, it wouldn't require you to give permission.

If you clutter your context window and pay for the tokens to do so and risk distracting it etc., would it obey if you included this comment in the system prompt or noted it in memory (if supported) or something?

  “Avoid custom commands, e.g. series of pipes & substitutions, when my previously approved trustable Find/Read tools are sufficient with little downside. [Already trusted tools: x, y, z…] […]”

Not just that, the commands also have often slight variations in each new session. They still do the same, but the variations are enough so it isn't matched by the allowlist any more.