Why a Confirm Button Alone Cannot Secure AI Coding Agents

Security researchers warn that approval dialogs in AI coding agents create a false sense of security when the displayed action differs from what the system actually executes. Symlinks or other layers of indirection can cause a file write to land at a different path than the one shown to the user, meaning the human approves one operation while the machine runs another. The core problem is that most agent workflows collapse three distinct objects — user intent, the model's description, and the runtime's resolved operation — into a single prompt. Experts argue that approvals must bind to computed facts such as the resolved resource path, tool version, and credentials, and should be invalidated if any material detail changes before execution. A structured approval envelope covering preparation, display, binding, execution, verification, and recording is proposed as a more reliable alternative to broad session-level permissions.