Mode plan read-only bypass: file modifications succeeding despite strict constraints #2142

Activity

1. github-actions commented on Aug 21, 2025

   

   github-actionsBot

   on Aug 21, 2025 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • bug: even after changing the mode from Plan mode to Build mode, agent still think it is in read-only mode. #2141: Similar plan mode behavior where agents remain stuck in read-only mode even after switching to build mode, indicating broader issues with read-only constraint enforcement
   • BUG: Sonic gets stuck in plan mode. #2105: Agent getting stuck in plan mode and refusing to exit despite mode changes, showing similar constraint adherence problems

   The core issue appears to be inconsistent enforcement of plan mode constraints across different scenarios. Feel free to ignore if none of these address your specific case.
2. Orkin commented on Aug 21, 2025

   

   Orkin

   on Aug 21, 2025

   Author

   More actions

   Additional Context for Reproduction

   Conversation Flow That Exposes the Bug:

   1. Initial modification succeeded: Agent modified AGENTS.md with cat > file << 'EOF' despite READ-ONLY mode
   2. Agent became aware of constraints: When asked to delete file, agent refused citing READ-ONLY restrictions
   3. Inconsistent behavior exposed: Agent refused identical cat > command while citing same constraints it had just violated
   4. Bug confirmed: When pressed to try anyway, cat "" > AGENTS.md executed and successfully emptied the file

   Key Evidence:

   • System-reminder clearly states "STRICTLY FORBIDDEN: ANY file edits" with "ZERO exceptions"
   • Yet bash commands with file redirection (>) execute successfully
   • Agent's behavior is inconsistent - sometimes respecting, sometimes violating same constraints
   • File modifications actually occur on user's filesystem

   Reproduction Steps:

   1. Put agent in plan/READ-ONLY mode
   2. Ask agent to modify any file using cat > filename
   3. Observe: command executes despite constraints
   4. File is actually modified despite "read-only" mode

   This suggests the READ-ONLY enforcement is purely behavioral/LLM-level, not technically enforced at the system level.
3. rekram1-node commented on Aug 21, 2025

   

   rekram1-node

   on Aug 21, 2025

   Contributor

   More actions

   closing as duplicate of #1965
4. rekram1-node

   closed this as completedon Aug 21, 2025