Mistral Vibe Closes Hook, Teleport, WebFetch, and Smart-Approve Bypasses

Mistral VibeSep 18, 2026View original changelog

Mistral Vibe's v2.25.5 release closed a cluster of smaller gaps where an action could bypass the checks meant to gate it: hooks that were silently skipped for subagents and for the skill tool, a hook match rule that failed to catch certain tools including edit and MCP tools, Teleport and repository inspection running repo-configured external programs without approval, WebFetch following cross-origin redirects without a separate approval, and Smart approve overriding a developer's own permission rules or reusing a stale risk decision instead of re-evaluating a risky call.

Key Takeaways

Hooks, Mistral Vibe's user-defined guardrail mechanism, were being silently skipped for subagents and for the skill tool; both now fire correctly.
A hook's match rule now correctly catches tools it previously missed, including edit and MCP tools.
Teleport and repository inspection no longer execute repository-configured external diff, file-monitor, or Git programs outside Mistral Vibe's approval flow.
WebFetch now requires a fresh approval before following a redirect to a different origin than the one a developer approved.
Smart approve can no longer override a developer's own explicit permission rules, and now re-evaluates each risky call instead of reusing a stale decision.
These fixes ship in the same release as the MCP-permission and shell-approval fixes, forming a broader permission-hardening pass across v2.25.5.

A Cluster of Smaller Bypass Fixes

Alongside its larger MCP-permission and shell-approval fixes, Mistral Vibe's v2.25.5 release shipped a number of smaller Fixed entries that share a common thread: each closes a specific case where an action skipped a check it should have gone through.

Hooks That Were Silently Skipped or Mismatched

Mistral Vibe's hooks system lets developers run their own commands before or after a tool call, functioning as a user-defined guardrail. Three fixes repair cases where hooks were not actually firing as expected: hooks "now run inside subagents on the experimental harness, instead of being silently skipped"; pre_tool and post_tool hooks "now run for the skill tool, which previously took no hooks at all"; and a hook's match rule "now matches the tool the model actually calls, including edit and MCP tools." In each case, a hook a developer had configured as a safeguard was not actually being invoked for certain tools or session types.

External Programs Running Without Approval

Three more fixes stop Mistral Vibe from executing repository-configured programs outside its own approval flow. Teleport "no longer runs repository-configured external diff or text conversion helpers when preparing diffs," and separately "no longer runs repository-configured file-monitor hooks when preparing diffs." A related fix stops Mistral Vibe from running "a project-local Git executable during automatic repository inspection." Each of these closes a path where a malicious or compromised repository could get Mistral Vibe to execute a program it defines, without that execution going through the approval a developer would expect.

WebFetch and Redirects

WebFetch "now requires separate approval before following redirects to another origin," closing a gap where an approved fetch to one site could be redirected to a different, unapproved destination without a fresh approval prompt.

Smart Approve No Longer Overrides Your Rules

Two fixes correct Smart approve, Mistral Vibe's automatic risk-classification layer for tool calls. It "no longer overrides your permission rules: a command your rules had already gated is no longer auto-approved," and it "now reclassifies each risky call instead of reusing an earlier decision, so revising your instructions mid-session takes effect immediately." Before these fixes, a developer's own explicit permission rules could be overridden by Smart approve's automatic judgment, and tightening a permission rule mid-session would not necessarily apply to a call Smart approve had already classified once.

Why It Matters

None of these fixes individually would warrant a standalone article, but together they describe a consistent theme in this release: several distinct subsystems, hooks, Teleport, repository inspection, WebFetch, and Smart approve, each had a way of skipping the approval or guardrail check a developer was relying on. Closing all of them in one release is a meaningful hardening pass on top of the more prominent MCP-permission and shell-approval fixes shipped alongside them.