01
A default is a decision someone else made for you
One overnight update can change whether your AI can run commands on your computer without asking. The rules of what a tool can do on its own can shift with any release — toward safer, or toward more access — and nobody emails you which way it went. The good news: the trend is increasingly toward asking first. But you can't assume that. So build one five-minute habit: after any AI-tool update, re-check three things — what it can run without asking, what it can delete, and what it can send out. This is the checklist.
02
The three things to re-check (every time)
After any update, walk these three in order. They map to the three ways an autonomous tool can hurt you:
| Check | The question to ask | Why it matters |
|---|---|---|
| 1. RUN | Can it execute commands / run code without asking me first? | Auto-run is the highest-impact permission — it can do anything your shell can do |
| 2. DELETE | Can it modify or delete files (or skip a confirmation) on its own? | An overconfident agent can wipe work that isn't committed or backed up |
| 3. SEND OUT | Can it make network calls / send data outside this machine? | This is where secrets, code, or customer data can leak without you seeing it |
Run, delete, send out. If you remember nothing else, remember those three verbs.
03
Where to find each setting
Exact labels differ by tool and change between releases, so check against your tool's own settings — but here's the map of what to look for:
- RUN — look for auto-approve commands, auto-run, YOLO/auto mode, or an allow-list of commands. Confirm whether it asks before executing, and whether any command is pre-approved.
- DELETE — look for auto-approve file edits/writes, auto-accept changes, or skip confirmation on delete. Confirm a destructive edit still prompts you.
- SEND OUT — look for network/web access, allowed domains/MCP servers, telemetry/data sharing, and any outbound tool permission. Confirm what the agent may reach.
- SCOPE — check whether these permissions apply globally or per-project/workspace, and whether the update reset them to a new default.
The point isn't a specific menu path — tools rename things constantly. The point is the three verbs and the habit of looking, because an update can move any of them.
04
Why this is on your radar now (the proof point)
This isn't hypothetical. Cline v4.0.0 (2026-06-26) flipped a default that controls exactly the RUN permission above. The release notes state it plainly:
- Verbatim: "Command auto-approval is now disabled by default for safer new and reset configurations."
- Translation: it used to let the AI run commands automatically; now, by default, it asks first.
- This is a GOOD change — the tool got safer. But notice the phrase "and reset configurations": an update touched a permission default. That's the whole lesson.
A default flipping toward safer is the friendly case. The same mechanism can move the other way in some future release of some tool — which is exactly why you re-check rather than assume.
05
The 5-minute habit
Make it mechanical so you actually do it. After every AI-tool update:
- Open the tool's permission / auto-approval settings before you start real work.
- RUN: confirm whether it can execute commands without asking. Set it to ask, unless you have a deliberate reason not to.
- DELETE: confirm a destructive file change still prompts you. Make sure your work is committed/backed up regardless.
- SEND OUT: review what network access and outbound tools are enabled. Disable anything you don't recognise or need.
- Note anything the update changed or reset, and decide consciously — don't inherit a new default by accident.
These tools get more autonomous every week. The one thing that should never be on autopilot is how much you let them do unattended.
06
A sane default posture
If you want a starting policy to fall back to:
- Ask before RUN — let the agent propose commands; you approve. Pre-approve only a tight allow-list of read-only commands if you must.
- Confirm before DELETE — keep destructive actions behind a prompt, and keep your work in version control.
- Allow-list SEND OUT — grant network/outbound access deliberately, to known domains/servers only.
- Re-verify after every update — treat each release as potentially having moved one of the three. Thirty seconds of looking beats a bad surprise.
Builder-protective, not alarmist: most updates are fine, and many make you safer. The habit just makes sure a change never decides for you silently.
Get the next drop
One AI safety habit a week, plus the occasional bonus template. No spam, unsubscribe anytime.
By submitting you agree to our Privacy Policy & Terms. Unsubscribe anytime.
You're in — check your inbox to confirm.
Frequently asked questions
What exactly should I re-check after an AI-tool update?
Three things, mapped to the three ways an autonomous tool can hurt you: what it can RUN without asking (execute commands/code), what it can DELETE on its own (modify or remove files), and what it can SEND OUT (network access / outbound data). Run, delete, send out.
Where do I find these settings?
Look for auto-approve/auto-run or a command allow-list (RUN); auto-accept file edits or skip-confirmation-on-delete (DELETE); network/web access, allowed domains/MCP servers, and telemetry (SEND OUT). Labels differ by tool and change between releases — check against your tool's own settings, and note whether the update reset anything to a new default.
Did a real tool actually change one of these defaults?
Yes. Cline v4.0.0 (2026-06-26) states: 'Command auto-approval is now disabled by default for safer new and reset configurations.' It used to let the AI run commands automatically; now by default it asks first. It's a good (safer) change — but it proves an update can move a permission default, which is why you re-check.
Isn't this just being paranoid?
No — it's builder-protective, not alarmist. Most updates are fine and many make you safer. The habit just makes sure a change never decides for you silently. Thirty seconds of looking after each update beats a bad surprise from a default you didn't know moved.
What's a sane default posture if I don't want to think about it each time?
Ask before RUN (approve commands; pre-approve only a tight read-only allow-list); confirm before DELETE (keep destructive actions behind a prompt and your work in version control); allow-list SEND OUT (grant network/outbound access only to known domains/servers); and re-verify after every update.