Mistral Vibe Closes Outside-Workdir Approval Bypasses
Mistral VibeMistral Vibe v2.25.8 fixed four related gaps in how it decides whether a file or shell action outside the current working directory needs approval. Relative path allowlists no longer authorize a file just because its path happens to end in an already-allowed suffix, shell command wildcards no longer skip outside-workdir path checks, legacy parent-folder grants no longer silently cover nested descendant paths, and an outside-workdir approval now applies strictly to the referenced file or, for a folder, its full tree. Together the fixes narrow several ways an agent could touch files a developer never explicitly approved.
Key Takeaways
- Mistral Vibe fixed four related gaps in outside-workdir approval enforcement, closing ways an agent could touch files beyond what was explicitly approved.
- Relative path allowlists no longer authorize files based on a matching path suffix alone.
- Shell command wildcards now go through the same outside-workdir path checks as literal paths.
- Legacy parent-folder grants no longer silently cover every nested descendant path underneath an approved folder.
- Outside-workdir approvals are now scoped strictly to the approved file, or a folder's full tree, and nothing beyond it.
- The fix continues a monthlong pattern of Mistral Vibe hardening its permission boundary, following CVE fixes in v2.25.4 and shell/git approval-scope narrowing in v2.25.5-v2.25.6.
Closing Outside-Workdir Approval Gaps
Mistral Vibe's v2.25.8 release fixed four related issues in how it decides whether an action that reaches outside the current working directory needs a developer's approval. Each one, on its own, is a narrow edge case; together they form a pattern the release notes group under the same theme: approvals meant to gate access outside the workspace were, in specific circumstances, not being enforced as strictly as intended.
Suffix-Matching Allowlists
Relative path allowlists previously authorized a file simply because its path happened to end with the same suffix as an already-allowed path. That meant a differently-located file sharing a trailing path segment with an approved one could slip through without its own approval. Mistral Vibe now requires an actual path match rather than a suffix match.
Wildcards and Legacy Grants
Shell command wildcards no longer skip the outside-workdir path checks that ordinary commands go through, closing a route where a wildcard expansion could reach files a literal path would have been blocked from touching. Separately, legacy parent-folder grants, approvals issued for a parent directory before Mistral Vibe's more granular path controls existed, no longer automatically cover every nested descendant underneath that folder. Some previously-silent outside-workdir accesses will now correctly prompt for approval again.
Scoped Approvals
Finally, an outside-workdir approval now applies strictly to the file a developer approved, or, when that approval targets a folder, to that folder's full tree rather than leaking scope elsewhere. The fixes follow a now-familiar pattern for Mistral Vibe this month: after patching CVE-numbered shell permission bypasses in v2.25.4, narrowing shell approval scope in v2.25.5, and hardening git fetch trust boundaries in v2.25.6, the team continues systematically tightening the boundary between what an agent is explicitly authorized to touch and what it can reach.