LM Studio redesigned its command reviewer after it approved risky commands

LM Studio published a description of Auto Review, the safety layer that checks shell commands issued by its Bionic coding agent. Amanda Caswell reported on it for The New Stack on 28 August.

The example that opens it is well chosen. git diff $base is an ordinary command. If $base holds a commit hash, it does what you expect. If $base resolves to --output=/some/file, Git writes to the filesystem.

Parsing structure instead of searching strings

Searching command text for dangerous words does not work, because what a command does depends on variables, redirects and nested commands. So the Shell Judge parses the command into an abstract syntax tree instead, using the mvdan/sh parser for Bash, Zsh and SH, and PowerShell's own syntax tree support.

From the tree it works out what LM Studio calls the command's capabilities: what it could read or change. It follows values across commands, so a result from git merge-base fed into git diff stays tracked. When a value has several possible outcomes, it follows up to 1,000 of them before giving up.

LM Studio says this first layer approves as many as 82 percent of commands with no model call. The article notes the company described that figure as anecdotal rather than a benchmark, which is the right way to read it.

There are 11,651 test cases behind the parser. The reason for that number is the many rare cases of tool-specific behaviour: ls -la treats -la as bundled flags, while TypeScript's tsc -vh does not behave like -v plus -h. Parsing the shell gets you partway. Knowing what each tool does with its arguments is the rest.

The part worth copying

Anything the parser cannot approve goes to a Shell Reviewer, a separate agent that judges the command in the context of the conversation.

The first version asked it whether the command should run. That did not work. LM Studio found the model sometimes approved risky actions because they appeared necessary to complete the user's request.

The fix is the interesting part. The reviewer now scores each command separately for risk, authorisation and correctness, and it is not told what scores are needed to pass.

Read that again if you write evaluations. A model asked for a verdict optimises for the verdict it thinks is wanted. A model asked to score three independent dimensions, with the threshold hidden, cannot tell what result is wanted.

The limits LM Studio states itself

The reviewer needs enough conversation to know whether the user authorised something, which creates a risk of prompt injection. Tool results are excluded, so instructions hidden in a fetched page do not reach it directly. It still sees assistant messages, and if the agent has already been compromised those messages can carry instructions.

The parser assumes executables like git have not been tampered with, and does not account for malicious configuration changing how a command behaves. On a machine where either has already been altered, the verdict comes from a parser reading the wrong thing.

Two layers, both with stated weaknesses, published by the vendor. That is a more useful safety document than most.

Source

• LM Studio built a judge for AI commands. Then the judge started agreeing with the defendant., The New Stack, 28 August 2026