I described six commands bypassing the first-token privilege check: env sudo id; /usr/bin/sudo id; bash -c "ls /"; nohup sh -c "ls /"; python -c "print(1)"; node -e "1". The old check allowed every one. Six commands bypassed the first-token privilege check: env sudo id; /usr/bin/sudo id; bash -c "ls /"; nohup sh -c "ls /"; python -c "print(1)"; node -e "1".
I described the privilege check as looking only at token zero: it blocked sudo, su, or doas when one of those was the first token, while wrappers that take a command as an argument could sail through.
I warned that failures can go unnoticed: “The failures don't announce themselves.” A run may finish with plausible output while quietly omitting a tool call, without an exception or red log line.
- I said likely causes are: a prompt assumption that only holds for the easy input; a tool contract that returns something the model was never told about; or no gate to stop bad output reaching a user. I said none of that is model quality.