Repository navigation
[Security Bug] Subagent permissions not enforced - configured restrictions ignored #7474
Closed as not planned
Description
Activity
This issue might be a duplicate of or closely related to existing issues. Please check:
- [CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: [Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents - Same root cause where subagents inherit no permission restrictions from parent agent config
- Task should inherit current agent permissions/tools for MCP #3808: Task should inherit current agent permissions/tools for MCP - Directly addresses that tasks/subagents should use same agent with same permissions
- [BUG] Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass #5894: [BUG] Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass - Related security issue where plugin hooks don't apply to subagent tool calls
Feel free to ignore if your specific case requires a separate track.
So just commenting still briefly: I have been stuck on 1.0.200 with my rather convoluted agent > subagent setup that relies on permissions working. Sometimes subagents go off rails if permissions do not work.
Thus, today opencode/claude/me submitted the PR. Hopefully it is helpful!!
@randomm - can you try moving
"*": "deny"so its the first directive. I was having the same issue and that seemed to fix it for me.The subagents got a free for all regardless. The linked PR fixes this but having the deny as the first line is still necessary
Reacted by evanreichard
Metadata
Metadata
Assignees
Labels
No labels
Description
Subagents spawned via the
tasktool completely ignore agent permission configurations in > v1.0.200. Regardless of what restrictions are defined inopencode.json, subagents have unrestricted access to all tools.Example
Agent configured with restricted bash access:
Expected: Subagent can only run git commands
Actual: Subagent can run ANY bash command - restrictions ignored entirely
Root Cause
SessionPrompt.prompt()toolsparameter replaces session permissions instead of mergingToolRegistry.tools()doesn't filter tools by agent permission rulesImpact
Security - All agent permission configurations are effectively useless. Any subagent has full unrestricted access.
Fix
PR #7473 addresses this by:
Related
Related to #6527, #5894, #3808