Approval laundering: an approval record names the command and misses what its install hooks do.

arXiv 2609.28586 shows that approving npm install or an MCP call produces a record omitting the transitive effects, lifecycle hooks, file writes, network access. Across 111 approval/trace pairs, unrecorded effects fell from 40 with explicit fields to 13 with decision-time metadata, and frozen effect predictions reached 0.926 macro recall and 0.941 precision on 17 holdout workflows, cutting residual effects from 10 to 3. They ship it as a Claude Code PreToolUse hook, so this is installable rather than theoretical.