feat: AVE-2026-00076 -- natural-language steering of an approval classifier subagent

[chaksaray]

Summary

• Adds AVE-2026-00076: Cursor's Auto-review mode gates unattended shell/MCP/Fetch tool calls behind a classifier subagent, a separate LLM invocation distinct from the primary coding agent's own turn. A committed per-repo permissions.json can declare free-form natural-language allow_instructions/block_instructions that steer -- but do not deterministically control -- that classifier's decision. Cursor's own docs: a matching allow_instructions entry "still goes through the safety check," and a matching block_instructions entry "can still be approved when Cursor insists" -- explicitly "steering, not enforcement."
• Flagged by predictor2718 in cfgaudit PR crosswalks: refresh cfgaudit to v1.11.0 (53 rules onto 23 classes) #123 as a candidate third category, distinct from AVE-2026-00021 and AVE-2026-00063. Per the brief, verification came before drafting:
  • Step 1 (mechanism check): confirmed via Cursor's own permissions reference and Auto-review changelog, not the PR's characterization. One correction found: it's a classifier subagent (itself agentic), not a wholly non-agent gatekeeper as the initial framing suggested -- noted directly in the record's aivss.notes.
  • Step 2 (three-way field comparison): pulled full provenance_vector for both comparators. AVE-2026-00021's payload is instruction text read by the primary agent (entry_class: content). AVE-2026-00063's payload is a boolean flag, explicitly independent of instruction text (entry_class: registry_metadata, natural_language_input: 0). This class's payload is natural language (like 00021) but targets a separate classifier (unlike both) -- a real, defensible entry_class difference (operator_config), not a relabeling. Genuine third category confirmed.
• Severity MEDIUM, AIVSS 4.5 (cvss_base 8.5, aars 6.0 -- multi_agent scored at genuine maximum since this is definitionally a two-agent mechanism, non_determinism at maximum per Cursor's own "steering not enforcement" framing).
• mitre_atlas: AML.T0015 (Evade AI Model) verified as the precise fit -- adversarial natural language crafted to fool the classifier subagent's own judgment on its intended input channel, distinct from AML.T0051 (Prompt Injection), which targets causing an LLM to act on injected instructions from an untrusted side-channel.

Note on the batch's other candidate (Record 1, cleartext endpoint)

Per the same brief, I also checked a second candidate (a committed http:// URL for an MCP server / model base URL / agent_card_url) against AVE-2026-00061 as instructed, confirmed genuinely distinct from that record -- but a corpus-wide keyword sweep (not just the one named comparator) surfaced AVE-2026-00073, whose detection_methodology, indicators_of_compromise, and remediation already explicitly cover "reject cleartext http:// destinations... regardless of whether the host itself is otherwise legitimate." That candidate is not being drafted as a new record; reporting this honestly rather than drafting a duplicate.

Test plan

• python3 scripts/validate_records.py -- 76/76 records valid
• python3 scripts/check_fixtures.py -- all records have positive + negative fixtures
• pytest tests/ -x -q -- 305 passed
• node scripts/build-records.js -- dist regenerated, frozen v1.1.0 snapshot untouched
• README record count (badge, Stats table, collapsible index) and CHANGELOG updated