Mistral Vibe Closes a Mid-Turn Mode-Switch Permission Gap

Mistral VibeSep 9, 2026View original changelog

Mistral Vibe's v2.25.1 release fixed a gap in how its permission system re-applies rules when a developer changes agent mode in the middle of a turn. Because the mid-turn configuration graft dropped an internal provided_tool_mode flag, leaving Smart Approve mode partway through a turn stopped Mistral Vibe from asking approval for built-in tool calls, while it kept classifying every connector call. The fix makes a mid-turn mode switch re-gate both built-in and MCP/connector tools consistently, so the approval behavior a developer selects takes effect immediately no matter when in the turn they select it. It shipped alongside other Smart Approve bypass fixes in the same release.

Key Takeaways

Mistral Vibe's Smart Approve mode stopped correctly gating built-in tool calls when a developer switched away from it mid-turn, while connector and MCP calls kept being classified.
The root cause was a dropped provided_tool_mode flag in the configuration graft that carries a mode switch into an already-running turn.
The bug created a gap between configured and actual behavior: a developer's chosen, stricter permission mode did not always take effect immediately for built-in tools.
The fix re-gates both built-in and MCP/connector tools whenever the agent mode changes mid-turn, closing the inconsistency between the two tool categories.
It shipped in v2.25.1 on September 9, 2026, alongside a separate fix stopping Smart Approve's fast-approval pre-check from waving through secret-dumping git commands.
The fix is part of a broader September 2026 push by Mistral Vibe to close approval-bypass gaps in Smart Approve, following a debugpy listener removal and a hooks.toml shell-injection fix in the same release.

A Mode Switch That Didn't Fully Take Effect

Mistral Vibe's Smart Approve mode is designed to auto-approve low-risk tool calls while still gating riskier ones, and developers can switch out of it mid-turn if they want stricter oversight. Mistral Vibe's v2.25.1 release fixed a bug where that switch did not always take effect for every kind of tool call.

The root cause was an internal flag, provided_tool_mode, that carries the newly selected mode into an already-running turn. When a developer left Smart Approve mid-turn, the configuration graft that should have propagated the new mode dropped this flag. The practical effect, as the release notes describe it: Mistral Vibe stopped asking for approval on built-in tool calls even though the developer had just switched to a mode that should have required it, while it kept classifying every MCP and connector call in the same turn. The two tool categories fell out of sync with each other and with the mode the developer thought they were running under.

Why It Matters

A permission mode that silently continues to apply its old, more permissive behavior after a developer has explicitly switched away from it is a real gap between configured and actual behavior, exactly the kind of divergence that matters for a coding agent capable of running shell commands and editing files on its own. The bug did not require any special exploit; it simply meant a mode switch mid-turn was incomplete for one class of tools.

The Fix

Mistral Vibe's v2.25.1 release corrected the mid-turn mode-switch logic so it re-gates both built-in and MCP/connector tools whenever the agent mode changes, removing the inconsistency between the two tool categories. The fix shipped alongside several other Smart Approve corrections in the same release, including removal of an unauthenticated debugpy listener and a fix that stopped Smart Approve's fast-approval pre-check from waving through commands like git diff or a cd into a hidden directory that could otherwise dump secrets. Together, these changes tightened several distinct paths by which a tool call could avoid an approval check it was supposed to go through.