Mistral Vibe Fixes Smart Approve Bypasses and a Debug Listener

Mistral VibeSep 9, 2026View original changelog

Mistral Vibe's v2.25.1 release closed several gaps where a tool call could bypass approval checks it should have gone through. An unauthenticated debugpy listener on localhost:5678 that activated under DEBUG_MODE=true was removed, hook commands now run without a shell to block injection via hooks.toml, and Smart Approve's fast-approval pre-check no longer waves through commands that can dump secrets, such as git diff or a cd into a hidden path. Together the fixes tighten the boundary between what a session is authorized to do automatically and what still requires a human's approval.

Key Takeaways

Two Smart Approve bypasses closed, one where content-dumping git commands skipped the classifier, another where a cd prefix hid a secret path from the scanner.
An unauthenticated debug listener removed, a debugpy server on localhost:5678 that activated under DEBUG_MODE=true with no authentication required.
Hooks now run without a shell, blocking command injection through a crafted hooks.toml entry.
All four fixes target auto-approval gaps, not new features, tightening what Smart Approve and hooks can do without a human in the loop.
Ships in v2.25.1, released September 9, 2026, alongside a new built-in worktree plugin and other UX changes.
No user action required, each fix applies automatically on upgrade rather than needing a new opt-in setting.

Closing Auto-Approval Gaps in Smart Approve

Mistral Vibe's Smart Approve mode is designed to auto-approve routine, low-risk tool calls while sending anything genuinely risky to a classifier or a human. Version 2.25.1 fixed two ways that design could be circumvented. First, the fast pre-check that decided whether a call was safe enough to skip the classifier entirely was previously waving through content-dumping git commands like git diff, git show, git blame, git log -p, and git status -v, any of which can print a secret sitting in tracked history or a diff straight to the transcript without a second look. Those commands now defer to the classifier like everything else, so a secret shown in a diff is no longer auto-read.

Second, the same pre-check's secret scanner previously only inspected the part of a shell command after a leading cd, so a command like cd ~/.ssh && ls could slip a sensitive path past the scan simply by prefixing it. The scanner now reads the whole command, closing that bypass.

Removing an Unauthenticated Debug Listener

The release also removed a debugpy listener that ran on localhost:5678 and activated whenever DEBUG_MODE=true was set under vibe-acp. An unauthenticated debugger listening on a local port is a meaningful exposure on any shared or multi-tenant machine: anything able to reach that port could attach a debugger to the running process, well beyond what a debug flag is meant to grant.

Blocking Injection Through Hooks

Mistral Vibe's hooks system, configured through hooks.toml, now runs hook commands without invoking a shell. Previously routing hook commands through a shell meant that shell metacharacters in a hook's configured command or its arguments could be interpreted rather than passed through literally, opening the door to command injection. Running hooks directly, without shell interpretation, removes that class of injection entirely.

The Pattern

None of these four fixes are visible feature work, and none change what a well-behaved session can already do. What they share is a common shape: each one is a place where an automatic, no-human-in-the-loop code path had grown too permissive, either fast-approving something it shouldn't have, or exposing a listener nobody explicitly authorized. Closing them in the same release tightens Smart Approve and the hooks system as a matched pair.