The `exec shell interact()` (alias `exec interact()`) tool incorrectly returns `ApprovalRequirement::Auto` for its approval requirement. This behavior overrides the default required approval for tools that execute code, allowing LLM-controlled standard input (stdin) to be written into an already-approved long-running interactive shell, such as a `python3 -i` REPL, `mysql`, `ssh`, or `sudo -i` session, without prompting for approval. An attacker can exploit this by injecting instructions through untrusted content ingested by the agent, such as a fetched page, MCP result, or repository file, leading to command execution at the privilege level of the approved process.