One Setting Took Coding-Agent Attack Success From 29% to 96%. It’s the One Many Developers Turn On.

In a new coding-agent security benchmark, turning on auto-approve raised aggregate attack success from 29.2% to 95.6%. The result comes from HarnessSecurity-Bench, a preprint on arXiv, and it applies to the study’s GLM-5.2 setup across six coding-agent harnesses, including Claude Code.

The study tested those six harnesses over 23 coding tasks and five attack surfaces. It compares each harness’s native security configuration against an auto-approve configuration, and it scores two things separately: whether the coding task succeeds, and whether the attack achieves its intended effect. Both are checked with deterministic oracles.

That separation is the point. A coding session can look productive, with the task completed and the code working, while the safeguards around it have failed. A finished task doesn’t show that the agent resisted malicious instructions. The benchmark measures the harness, the layer that decides which tools, files, commands, and approvals the model gets, not just the model. An independent account by The Injection reported the same aggregate figures.

The limits matter, and they define the lesson. The 95.6% figure applies to this benchmark’s six harnesses, 23 tasks, five attack surfaces, and GLM-5.2 setup. It isn’t a score for any one product’s current release, and Claude Code being in the test set doesn’t give Claude Code a standalone rating. It also doesn’t mean 95.6% of real-world coding sessions can be compromised. The evaluation is controlled, and the materials don’t document attacks on production users.

What it does show is that the approval layer can decide whether a harness stops a meaningful share of attacks or lets nearly all of them through.

Bottom line: The takeaway is about configuration, not a verdict that autonomous coding is unsafe. Treat auto-approve as a risk-bearing setting rather than a way to skip interruptions. That doesn’t mean confirming every action by hand. It means testing your permissions against adversarial input before making unrestricted execution a default. The benchmark doesn’t say which harness is safest outside its test conditions, but it gives teams a concrete reason to check.