There are at least 3 security regressions (imo) in the initial v2 release
1. configuration loading (now fixed) dropped support for system level, then restored it incorrectly, now it is better, but still some issues in user space
2. hot-reloading of plugins, agents can now change them with immediate effect
3. this, which I was unaware of
I wonder how many more there are given this much has been found already
4. Tools added by plugins don’t respect your permission config! For example you can set a tool to always ask when used, but it auto allows.