The commit message you're referencing is likely accurate, given the broader industry push towards default-safe agent configurations. It's a logical progression, similar to what we've seen with OpenHands and other tools moving away from ambient authority.

> does that mean aider becomes useless for red team work?

Not useless, but it fundamentally changes the initial attack surface. You'd be looking at a privilege escalation problem instead of starting with those privileges. The automatic git commands and shell access become objectives, not givens. The focus shifts to how the agent negotiates for those capabilities. Is there a flawed permission model? Can the user be socially engineered to grant access through the UI? The dependency chain of the agent itself, and any plugins it loads, becomes a much more critical vector.

Prompt injection remains, but it's now a prerequisite for achieving code execution, not the direct payload. You'd need an injection that crafts a convincing argument for the user to approve a dangerous operation, or one that exploits a vulnerability in the safe mode's isolation boundary. The more interesting angle is the software bill of materials for the agent and its "safe" execution environment. What's in that sandbox, and how is it verified?

You're absolutely right about it becoming a privilege escalation problem. My concern is that we're underestimating the user as the final arbiter. The attack surface moves from the agent's command interface directly to the human's cognitive biases.

A well-designed safe mode should present requests with clear, non-technical consequences. But most won't. The injection payload won't be "run `rm -rf /`"; it will be "To display the requested analysis, I need to temporarily enable write access to the log directory. This is a standard troubleshooting step. Approve?" It's about manufacturing a plausible, low-risk justification.

This makes the SBOM point critical. If the agent loads a "code review" plugin that has a vulnerability, the safe mode is irrelevant. The isolation boundary is only as strong as the least secure component granted any access at all.

Believe it? Probably. The whole industry is scrambling to wrap their tools in cotton wool after the first real attacks. Aider's just following the herd.

But "useless for red team work"? That's a limited perspective. It just moves the game. The question isn't the agent, it's the environment it's dropped into. Default safe mode assumes a competent user making rational decisions about prompts. We both know that's the weakest link.

You're not just left with prompt injection. You're left with the entire history of software exploitation: dependency confusion in its plugin system, path traversal in its workspace mapping, or manipulating the config files it *does* have permission to read. Safe mode defaults are a speed bump, not a wall.