LM Studio built a judge for AI commands. Then the judge started agreeing with the defendant.

LM Studio has been trying to give coding agents a better sense of when a shell command is safe to run. The company’s Auto Review sits in front of Bionic and tries to judge a command before another model gets involved. If it can’t tell, it hands the job off. In a blog post on Thursday, LM Studio said that first pass cleared as many as 82% of Bionic’s commands without calling a second model, though the author called that number anecdotal rather than a benchmark.

The core trick is to stop treating commands like raw text. Shell commands mutate once variables, redirects, and nested commands enter the picture, so a simple search for bad strings misses too much. Bionic’s Shell Judge parses commands into abstract syntax trees and follows what variables and subcommands might do. It uses the mvdan/sh parser for Bash, Zsh, and SH, while PowerShell gets its own AST support. From there, the judge tries to infer the command’s “capabilities” — what it could read or change.

That matters for ordinary-looking commands that turn weird when values are substituted. LM Studio’s example is git diff $base. If $base is a commit hash, fine. If it resolves to --output=/some/file, Git can write to the filesystem. The same logic can carry values from one command into the next, so if git merge-base feeds git diff, the judge keeps track of that result. It will follow up to 1,000 possible values before giving up on enumerating every possibility.

The company has also built 11,651 test cases to catch the edge cases that make this kind of parser work painful. Some are malformed commands. Others are about tool-specific behavior, like ls -la treating -la as bundled flags, or TypeScript’s tsc -vh not behaving the same as running -v and -h separately. Parsing the shell is only half the fight; the tool itself still gets a say in what happens next.

Anything the Shell Judge can’t settle goes to the Shell Reviewer, another AI agent that checks commands in the context of the conversation. That second layer had its own failure mode: when LM Studio simply asked whether a command should run, the model sometimes approved risky actions because they seemed necessary to satisfy the user. Now it rates risk, authorization, and correctness without being told what score will pass. Even then, the trust model stays leaky. Tool outputs are excluded, but assistant messages still come through, which means a compromised Bionic could smuggle instructions along for the ride.