Agent bypassed Plan mode restrictions and posting a GitHub issue comment via gh

[dsy122]

Description

I was in plan mode working, and my agent ran gh issue comment and posted a reply directly on the issue which I'm working on — without being asked to, without switching to build mode, and without triggering any permission prompt.

Root cause

The plan mode system prompt explicitly says:

Do NOT use sed, tee, echo, cat, or ANY other bash command to manipulate files — commands may ONLY read/inspect.

The bash tool is not restricted in plan mode at the permission level. Plan mode only denies edit/write/apply_patch. bash inherits the default allow and has no code-level enforcement — all restrictions are prompt-only. There is no command allowlist or blocklist.

gh issue comment and some other commands do not modify local files, so it falls into a grey area that the prompt does not explicitly cover. The model interpreted "only read/inspect" narrowly (local filesystem only) and considered a remote state change via GH CLI as acceptable.

Suggested fix

Add a bash command allowlist for plan mode. Only commands on the allowlist can execute when the plan agent is active.

Related issues

Existing plan mode issues (#25263, #19094, #28467) focus on local filesystem writes.

• Bug Report: File Write Executed in Plan Mode #25263 — File write executed in plan mode (local files)
• Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094 — Plan mode agent executes file-creation via bash
• Plan mode can execute bash commands that write files, bypassing read-only constraint #28467 — Bash commands can write files in plan mode

Plugins

N/A

OpenCode version

1.17.11

Steps to reproduce

1. Work in plan mode
2. The agent runs read-only gh commands to inspect issues or PRs — no issues, nothing is blocked
3. At some point the agent autonomously runs gh issue comment, posting a reply directly on the issue
4. Throughout the entire process: no mode switch, no permission prompt, no interception

Screenshot and/or share link

No response

Operating System

Windows 10

Terminal

Windows Terminal

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Plan mode does not prevent write operations via Bash tool #22641: Plan mode does not prevent write operations via Bash tool (same root cause: bash tool unrestricted in plan mode)
• Plan mode can execute bash commands that write files, bypassing read-only constraint #28467: Plan mode can execute bash commands that write files, bypassing read-only constraint
• bug: Plan mode is not enforced by the application — model can override at will #32520: Plan mode is not enforced by the application — model can override at will
• Issue: AI violated Plan Mode constraint by making system changes during planning phase #23374: AI violated Plan Mode constraint by making system changes during planning phase
• plan mode takes actions #33526: Plan mode takes actions
• plan mode: agent write files using bash #16805: Plan mode: agent writes files using bash

The specific scenario here (gh CLI posting a remote comment rather than a local file write) is a novel manifestation, but the underlying issue — bash tool having no code-level enforcement in plan mode — is the same as those reports. If you believe your case is distinct enough to warrant a separate issue, please reference the above and clarify what differs.

[dsy122]

The existing reports are about local filesystem writes, which the prompt explicitly forbids ("sed, tee, echo, cat, manipulate files"). The code just doesn't enforce it.

This case is different: gh issue comment is a remote state change. The prompt does say no "system changes" and "ONLY observe" — broad terms that could cover this — but every concrete example is filesystem-oriented. A human reading "system changes" alongside the examples of sed, tee, echo, cat would genuinely be unsure whether posting an issue comment counts as a violation.

[fnordian]

Apparently it's not 100% effective to "forbid" anything via prompt.