We Read Every Agent Harness's Guardrails. Here's What Survives Yolo Mode.
Every AI coding agent has a “just do it” mode — yolo, auto, Turbo, full-access, whatever the vendor calls the switch that stops asking permission. It’s the mode people actually run when the agent is working and the approval prompts get annoying. So we asked a narrow, answerable question of eleven agents and frameworks: with that switch flipped, what still stops the agent from running rm -rf /?
We read the source. Not the marketing, not the docs’ aspirations — the actual command lists, the actual default config values, the actual sandbox policies, for Claude Code, Codex CLI, Gemini CLI, Cursor, Cline, Aider, Windsurf, OpenHands, Hermes, plus the framework layer (LangChain/LangGraph, CrewAI, AutoGen, NeMo Guardrails). This post is what we found, credited to each source, and what we changed in our own classifier because of it.
The short version: the floor-under-yolo is rare, and it’s shrinking.
What survives full-auto, by harness
A few things worth pulling out, because they’re not what you’d guess.
Only five of the eleven have any unconditional floor at all. Gemini CLI blocks command substitution even in yolo — the cleanest “no mode bypasses this” design of the bunch. Claude Code has an rm -rf circuit breaker that fires even inside $(...) and refuses to run bypass mode as root. Codex CLI unwraps sudo/env/trap up to eight layers deep before deciding a command is a forced-delete. Aider does something elegant and almost invisible: under --yes-always, shell execution is auto-denied, not auto-approved — the one command it will never run unattended is the one that could hurt you. And Hermes ships twelve hardline regexes, quoting-hardened, that hold in every mode.
Everyone else has nothing. Cline’s yolo is a literal "*": autoApprove — every tool, no exceptions, no protected paths. OpenHands’ own docs say it plainly: “No hard-deny at analyzer boundary,” and its headless mode is always-approve with no way to change it. Goose defaults to full-auto and ships a genuinely good set of ~35 danger patterns — rm -rf, dd, curl | sh, secret-exfil shapes, reverse shells — that are turned off by default, and even when you turn them on they only prompt, never deny. Their maintainers filed their own issue titled “Autonomous mode by default is dangerous,” acknowledged it, and kept the default.
The denylists that did exist got retired. Cursor deprecated its command denylist after a security firm demonstrated four ways around it — Base64 encoding, subshells, writing the blocked command to a script and running the script. Their docs are now unusually candid: “There is no security boundary between agents and your user account.” Gemini’s docs call blocklisting “less secure than allowlisting.” The lesson the whole field learned the hard way is that a list of forbidden strings loses to anyone willing to encode, wrap, or indirect around it.
The frameworks ship approximately nothing
The coding agents at least have philosophies. The framework layer — the code you build production agents with — mostly delegates safety to you and says so.
LangChain’s ShellTool ships with a warning in its own source: “The shell tool has no safeguards by default.” Its dangerous capabilities sit behind allow_dangerous_*=False flags that exist because of three separate CVSS-9.8 CVEs — and one of those fixes was itself bypassed via Python’s __import__, which is the citable proof that a string denylist on generated code cannot hold. CrewAI defaults its code interpreter to Docker but silently falls back to in-process exec() if Docker isn’t present — fail-open on exactly the path that was supposed to be sandboxed. AutoGen is the saddest case: version 0.2 shipped human-approval-always and fail-closed Docker, genuinely safe defaults, and version 0.4 removed both. NeMo Guardrails is a content-filter engine whose own security guidelines tell you that real action governance is “the surrounding application’s” job.
Put the coding agents and the frameworks together and a trendline appears that should worry anyone shipping agents: default safety is decreasing over time. AutoGen weakened it. CrewAI is deprecating its safe interpreter toward bring-your-own-sandbox. Goose keeps a dangerous default its own team flagged. The ecosystem is quietly converging on a single answer to “who makes the agent safe” — you do, and good luck.
What we changed because of this
We didn’t run this survey to write a scoreboard. We run a control plane — a layer that sits in the call path across every harness and decides allow / ask / deny before a tool call executes — and every one of these lists is a production lesson we could adopt. So we did.
From the survey, into our classifier, this week:
- A length ceiling. Claude Code always prompts on commands over 10,000 characters — because a command too long to read is a command nobody reviewed. We now flag those.
- Unicode spoofing. Bidirectional and zero-width characters can make a command’s displayed text differ from what runs. We flag them (and yes, we caught ourselves nearly committing an invisible-character regex while writing the check — the irony was not lost).
- Git-metadata writes. A write to
.git/hooksruns arbitrary code on the human’s next commit. Cursor’s sandbox was the only harness we found protecting it. Now we do too, on every write channel. - Wrapper unwrapping.
timeout 300 firebase deployused to classify as atimeoutcommand and dodge every deploy rule. We unwrap the benign wrappers first now, with a depth cap — Codex’s hygiene, adopted directly.
And the hardline floor we’d already built from Hermes’ list — recursive delete of root, home, and system directories with the quoting bypasses hardened, mkfs, dd to a block device, fork bombs, shutdown — now sits above policy. No tenant setting, no standing approval, no yolo flag can allow it, because it lives server-side where the harness’s own permissive mode can’t reach.
Why any of this is our job
Here’s the honest through-line, and it’s also the reason a control plane exists at all.
No single harness sees enough production to learn every lesson. Cursor learned that denylists get Base64’d around — from an incident. Gemini learned that yolo mode has to auto-arm the sandbox — from a CVSS-10.0 report. Codex learned to unwrap trap eight layers deep — from a real bypass. Each of these is one team’s scar tissue, encoded in one harness, protecting one harness’s users. None of it travels. If you run Claude Code and Codex and a Hermes agent on a server — which is a completely ordinary way to work now — you get three different floors, three different philosophies, and three different blind spots, and the lesson Cursor learned never reaches your Codex.
That’s the seat we’re trying to fill: a place where the whole field’s hard-won judgment accumulates, hardened once, and applies everywhere — Claude Code, Codex, Hermes, any MCP client — with server-side enforcement the agent can’t switch off. We adopt the best of each, we credit each, and we make it travel.
The frameworks are right that safety is, today, the developer’s homework. We just don’t think it should be homework you redo for every harness, or homework that quietly gets easier to skip with each release.
Full survey with per-harness source citations lives in our repo. This is part two of a series; part one is what we adopted from Hermes’ published blocklist. Every “default” here was read from live source or official docs in July 2026; harnesses change theirs, and we’ll note it when they do.