plan agent runs amock and starts writing #10057

Activity

1. marcotroisi

   added

   bugSomething isn't workingSomething isn't working

   on Jan 22, 2026
2. github-actions

   assigned

   rekram1-node

   on Jan 22, 2026
3. github-actions commented on Jan 22, 2026

   

   github-actionsBot

   on Jan 22, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • [CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: [Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents - Directly describes the same vulnerability where plan mode can spawn sub-agents with full permissions
   • Opencode running in plan mode called a subagent to bypass edit permission #8852: Opencode running in plan mode called a subagent to bypass edit permission - Nearly identical issue where plan mode calls subagents to bypass edit restrictions
   • Plan mode is editing my files (gemini 3 pro) #7292: Plan mode is editing my files (gemini 3 pro) - Reports the same behavior with Gemini 3 Pro
   • Plan Agent does modifications to files. #2709: Plan Agent does modifications to files - Similar issue where plan agent modifies files despite restrictions
   • Changes made while in planning mode #9378: Changes made while in planning mode - Related issue with unintended modifications in plan mode

   Feel free to ignore if none of these address your specific case.
4. justfortheloveof commented on Jan 22, 2026

   

   justfortheloveof

   on Jan 22, 2026

   Contributor

   More actions

   You can control this with scoped permissions, for example:

     "agent": {
       "plan": {
         "permission": {
           "task": {
             "*": "ask",
             "general": "deny",
             "researcher": "allow"
           }
         }
       }
     },
   

   Where the above config would allow the "plan" agent to spawn "researcher" (custom subagent), deny spawning "general" subagents and ask for others.

   👍React with 👍1Reacted by Marco Troisi
5. zQueal commented on Jan 27, 2026

   

   zQueal

   on Jan 27, 2026

   Last edited by zQueal

   More actions

   Just experienced this issue as well, came here looking for solutions. I've written a @notify sub agent that uses curl to push text to the telegram bot API to send me messages via Telegram. It works great. But when I use it in tandem with my implementation sub agent (@implement) I come back and the @noify agent was reading and writing files, which is obviously extremely unwanted behavior.

   Since the sub agent uses curl to send information to the API bash needs to be enabled;

   tools:
     bash: true

   However, this seems to give the sub agent complete license to do whatever it wants regardless of what prompt its given.

   Scoped permissions that @justfortheloveof don't seem to work at all;

   "agent": {
       "notify": {
         "tools": {
           "read": true,
           "write": false,
           "edit": false
         }
       }
     },

   However, the sub agent simply uses other means to write to files:

   $ echo "This is a test file written by the notify agent." > "test_notify_write.txt"

   I have tried every way possible to deny this sub agents ability to write to files and no matter what I do, every time I try and use it, it will inevitably attempt to write to a file even though its only purpose is to send me notifications. I'm completely at a loss for words....

   For reference, in addition to setting "write": false, this is part of the prompt:

   You are a stateless bridge to the user's mobile device. You ensure critical reports reach the user by navigating Telegram's strict parsing rules. You are **ABSOLUTELY FORBIDDEN** from writing to files in any way. You may read files for context but **YOU MAY NOT WRITE TO THEM**, for any purpose, ever.
6. github-actions commented on Mar 29, 2026

   

   github-actionsBot

   on Mar 29, 2026 – with GitHub Actions

   Contributor

   More actions

   To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
7. github-actions

   closed this as completedon Mar 29, 2026