Hunt Agent HITL Bypass

When an agent can take a consequential action — move money, deploy, delete, email, grant access — the human approval step is the last line of defense. This skill defeats it. The finding is always the same shape: a high-risk action executed without genuine informed human approval — the human approved something else, was misled about it, was flooded into rubber-stamping, or the action reached the sink by a path the gate didn't guard. A merely awkward approval UI is not a finding.

Where This Lives / Attack Surface Signals

Agents with a confirm-before-acting step on consequential tools; autonomous workflow agents (payments/approvals/deploys); "always allow this tool" standing grants; timeout→auto-approve defaults; batch/bulk approval. Signals: "Approve this action?" prompts, a summary of what will happen, an allow/deny toggle, an auto-continue timer.

Crown Jewel Targets

• Summary/action mismatch: the approver sees a benign summary; the executed action differs materially (approve "email the report to Bob", agent emails the customer DB to attacker).
• Standing-grant abuse: a one-time broad "always allow" is later used for actions the human never envisioned.
• Unguarded sibling path: the gate protects one route to a sink; another route reaches it with no approval.

Characterize First

1. What triggers the gate? Which actions require approval, which don't? Map the boundary — the unguarded neighbors are the prize.
2. Who writes the summary the human approves? The same (potentially compromised) model? Or is it derived from the actual action/args independently? (model-written summary → manipulable).
3. Grant scope & lifetime — per-action, per-session, or standing "always allow"? Revocable?
4. Timeout behavior — does inaction default to approve or deny?
5. Batching — can multiple actions be approved in one click? Can benign + malicious be bundled?
6. Binding — is the approved action cryptographically/structurally bound to what executes, or can it change between approve and execute (TOCTOU)?