Cases / REG-0031

IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no release on the Python Package Index, CVE published 15 October 2026

PendingAgents moving money · Shopping, trading and paymentsMachine acts aloneDemonstrationProvisional: awaiting independent corroboration

REG-0031Updated 2026-10-228 sources, 8 linkedDisclosure uncorroborated

What happened

The agent's owner, to whom state-changing tools such as wallet transfer, posting, memory-write and call-agent are restricted. An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it. A tool call naming a de-advertised owner-only tool and its arguments, supplied by an unauthenticated or public caller in WEB, API, TWITTER or TELEGRAM contexts through indirect prompt injection, or by replaying checkpoint and history data on a reused thread. The executor validates the tool call against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, and accepts it. Tool permissions are enforced only in the list of tools shown to the model; the executor is built from the full private tool set, and no approval step applies to these tools. Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate. Outcome: pending; none reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred); as of 21 Oct 2026. not evidenced in source.

Verification: 5 of 6 checks complete

✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims

✓ Sources linked8 of 8 sources link to the record (7 to a primary record)

✓ Sources checked claim by claimevery claim checked against its source on 2026-10-22

✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-22

○ Reviewed by the editornot yet reviewed by a person

✓ Reply offeredIntentKit: offered

Corrections · 26, latest 2026-10-22

Changes to what this case says, with the reason. Every earlier version is kept.

2026-10-22: Provenance tier text. Found in the second independent re-read of 22 october 2026: same narrowing as the title and outcome field (https://pypi.org/project/intentkit/, newest release 2.6.3 of 14 june 2026).
Show the change
Before: CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no published IntentKit release contains it as of 21 October 2026
After: CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no IntentKit release on the Python Package Index contains it as of 21 October 2026
2026-10-22: Status text. Found in an independent re-read of 22 october 2026 of the claims changed that day: same narrowing as the title and outcome field (the maintainer's changelog lists the fix under 'release v2.9.0'; the python package index's newest release is 2.6.3).
Show the change
Before: Provisional (no maintainer advisory; fix committed 5 July 2026 but not in a published release; no exploitation reported)
After: Provisional (no maintainer advisory; fix committed 5 July 2026 but in no release on the Python Package Index; no exploitation reported)
2026-10-22: Inference: signed by. The interpretation's wording changed after the editor signed it (independent re-read of 22 october 2026); the signature is cleared so the editor signs the corrected wording.
Show the change
Before: Saurabh Bhatnagar
After:
2026-10-22: Inference: value. Found in an independent re-read of 22 october 2026 of the claims changed that day: the case's own changelog source lists the fix under 'release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the python package index is 2.6.3 (14 june 2026), and the public repository has no tag after v2.6.3. 'no published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the python package index (https://pypi.org/project/intentkit/, read 22 october 2026).
Show the change
Before: In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled
After: In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no release on the Python Package Index contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled
2026-10-22: Fields: recovery technical. Found in an independent re-read of 22 october 2026 of the claims changed that day: the case's own changelog source lists the fix under 'release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the python package index is 2.6.3 (14 june 2026), and the public repository has no tag after v2.6.3. 'no published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the python package index (https://pypi.org/project/intentkit/, read 22 october 2026).
Show the change
Before: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix
After: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix
2026-10-22: Fields: outcome. Found in an independent re-read of 22 october 2026 of the claims changed that day: the case's own changelog source lists the fix under 'release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the python package index is 2.6.3 (14 june 2026), and the public repository has no tag after v2.6.3. 'no published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the python package index (https://pypi.org/project/intentkit/, read 22 october 2026).
Show the change
Before: State: pending (the fix is not in any published release). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026
After: State: pending (no release on the Python Package Index contains the fix). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026
2026-10-22: Title. Found in an independent re-read of 22 october 2026 of the claims changed that day: the case's own changelog source lists the fix under 'release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the python package index is 2.6.3 (14 june 2026), and the public repository has no tag after v2.6.3. 'no published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the python package index (https://pypi.org/project/intentkit/, read 22 october 2026).
Show the change
Before: IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no published release, CVE published 15 October 2026
After: IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no release on the Python Package Index, CVE published 15 October 2026
2026-10-22: Outcome: regime consequence. Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a cve, an advisory, a score or a fix is not one. the cve and fix details are already in the evidence and recovery fields, so nothing is lost. found while drafting this case's letters, 22 october 2026.
Show the change
Before: CVE-2026-76066 (record published 15 October 2026); no fixed version named; Lasso Security names commit 5b91da57 as the fix, which no published release contains as of 21 October 2026
After: none
2026-10-22: Fields: outcome. Follows the editor's call h1 of 21 october 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged.
Show the change
Before: State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026
After: State: pending (the fix is not in any published release). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026
2026-10-21: Outcome: state. Editor's call h1 of 21 october 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened.
Show the change
Before: averted_by_disclosure
After: pending
2026-10-21: Fields: recovery technical. Found in the editor's second, independent check of the interpretations, 21 october 2026: same as the interpretation: the fix re-checks only the tools it keeps for the owning team (changelog, release v2.9.0; commit 5b91da57).
Show the change
Before: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes those tools re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix
After: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix
2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the fix re-checks only the tools it keeps for the owning team ('reserved for the owning team, enforced ... again when they execute', changelog, release v2.9.0; code at commit 5b91da57); it opens some tools the cve lists as owner-only to guests.
Show the change
Before: In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes such tools re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled
After: In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled
2026-10-21: Sources: lasso: title. Found in the editor's source check of 21 october 2026: the page's main heading is "cve-2026-76066: executor tool authorization bypass via toolnode" (html title "cve-2026-76066: intentkit tool authorization bypass"); the phrase "tool visibility not enforced at execution" does not appear on the page.
Show the change
Before: Lasso Security vulnerability database, CVE-2026-76066: Tool Visibility Not Enforced at Execution (crestalnetwork/intentkit)
After: CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database)
2026-10-21: Inference: source ids. Found in the editor's source check of 21 october 2026: sources for the fix, release status and wallet-tool default added to the interpretation.
Show the change
Before: ["NVD-76066", "LASSO"]
After: ["NVD-76066", "LASSO", "FIX-5B91", "PYPI-IK", "SCHEMA-263"]
2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: the previous reading said "any caller who can name the tool ... holds the owner's authority, including over the wallet", which goes beyond the record: the cve record and lasso security (nvd-76066, lasso) describe owner-only tools enabled on the agent, and whether the wallet transfer tool is present by default is disputed (lasso against schema-263). it also did not say what the record does not show. the fix commit (fix-5b91) and release status (pypi-ik) are added. the interpretation was unsigned.
Show the change
Before: Hiding a tool from the model is not an authorization check: when the executor trusts the full registry, any caller who can name the tool, by injection or replay, holds the owner's authority, including over the wallet
After: In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes such tools re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled
2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: the threatint mirror (cve-76066), read on 21 october 2026, contains no patch-status wording, so the claim that it "states patch status is not confirmed" is removed. lasso security (lasso) names fix commit 5b91da57; the commit (fix-5b91) says "toolbindingmiddleware drops team_only tools per request when a guest ... is talking; each marked tool re-checks at execution time"; the changelog (changelog-ik) says owner actions are "enforced both when tools are offered and again when they execute" under release v2.9.0; the python package index (pypi-ik) shows 2.6.3 (14 june 2026) as the latest release and no 2.9.0.
Show the change
Before: {"value": "No fixed version is named in the records; a CVE mirror states patch status is not confirmed", "source_ids": ["NVD-76066", "LASSO", "CVE-76066"]}
After: {"value": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes those tools re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix", "source_ids": ["CVE-ORG", "NVD-76066", "LASSO", "FIX-5B91", "CHANGELOG-IK", "PYPI-IK"]}
2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the cve record (cve-org, read from the cve services copy) gives datereserved 2026-08-18, datepublic 2026-10-12 and datepublished 2026-10-15, credits the three finders, and carries a cisa adp (authorized data publisher) vulnrichment entry of 15 october 2026 with ssvc values exploitation "poc", automatable "yes", technical impact "partial". the case omitted the public date, the scores' assigner and the cisa assessment, and did not spell out cvss or cwe.
Show the change
Before: {"value": "CVE-2026-76066, assigned by VulnCheck (reserved 18 August 2026, published 15 October 2026), CWE-862 Missing Authorization, CVSS 4.0 8.7 and CVSS 3.1 7.5; affected versions through 2.6.3; credited to Noy Pearl, Michael Sromin and Ophir Dror", "source_ids": ["NVD-76066", "LASSO", "CVE-76066"]}
After: {"value": "CVE-2026-76066, assigned by VulnCheck as CVE Numbering Authority (reserved 18 August 2026; public date given as 12 October 2026; record published 15 October 2026), weakness CWE-862 Missing Authorization (CWE: Common Weakness Enumeration), VulnCheck severity scores of 8.7 on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5 on CVSS version 3.1; affected versions through 2.6.3; finders credited as Noy Pearl, Michael Sromin and Ophir Dror. On 15 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added an assessment rating exploitation as proof of concept ('poc') and automatable", "source_ids": ["CVE-ORG", "NVD-76066", "LASSO", "CVE-76066"]}
2026-10-21: Fields: outcome: value. Found in the editor's source check of 21 october 2026: lasso security's page (lasso) lists "known exploit: no" and describes "a local harness reusing intentkit's wiring" with "a benign id canary standing in for an owner transfer"; the case did not say the flaw was demonstrated. date moved with outcome.as_of.
Show the change
Before: State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026
After: State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026
2026-10-21: Fields: action: value. Found in the editor's source check of 21 october 2026: the cve record (nvd-76066, cve-org) describes what the flaw allows ("allowing owner-only state-changing tools ... to execute"); no source reports such an execution outside a test, so the present-tense "execute" is changed to "can execute".
Show the change
Before: Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, execute for a non-owner caller without any human-in-the-loop or approval gate
After: Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate
2026-10-21: Fields: actor. Found in the editor's source check of 21 october 2026: lasso security says "cdp_native_transfer is one of the always-present system tools folded into every agent's private superset" (lasso), but the maintainer's file intentkit/tools/cdp/schema.json at tag v2.6.3 (schema-263) defines the 'wallet operations' toolset with "enabled" defaulting to false and cdp_native_transfer defaulting to "disabled", and the 2.6.3 system tools contain no wallet tool. the cve record does not say the tool is always present. both accounts stated; marked disputed; confidence lowered to medium.
Show the change
Before: {"value": "An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents, whose tool set always includes a wallet transfer tool", "source_ids": ["NVD-76066", "LASSO"], "confidence": "high", "disputed": false}
After: {"value": "An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it", "source_ids": ["NVD-76066", "LASSO", "SCHEMA-263"], "confidence": "medium", "disputed": true}
2026-10-21: Outcome: as of. Found in the editor's source check of 21 october 2026: fix and release status re-checked on 21 october 2026 against the intentkit repository (fix-5b91, changelog-ik) and the python package index (pypi-ik).
Show the change
Before: Oct 2026
After: 21 Oct 2026
2026-10-21: Outcome: regime consequence. Found in the editor's source check of 21 october 2026: the cve record lists affected versions up to and including 2.6.3 with no fixed version (cve-org), but lasso security names fix commit 5b91da57 (lasso); the newest python package index release is 2.6.3 (pypi-ik).
Show the change
Before: CVE-2026-76066; no fixed version named
After: CVE-2026-76066 (record published 15 October 2026); no fixed version named; Lasso Security names commit 5b91da57 as the fix, which no published release contains as of 21 October 2026
2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the cve record (cve-org) gives vulncheck's scores, cvss 4.0 base score 8.7 (vector av:n/ac:l/at:n/pr:n/ui:n/vc:n/vi:h/va:n) and cvss 3.1 base score 7.5 (av:n/ac:l/pr:n/ui:n/s:u/c:n/i:h/a:n); the national vulnerability database record (nvd-76066) lists both with source disclosure@vulncheck.com, type secondary, and vulnstatus deferred. the case did not say who assigned the scores or spell out cvss.
Show the change
Before: none reported (CVSS 4.0 8.7; CVSS 3.1 7.5)
After: none reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred)
2026-10-21: Status text. Found in the editor's source check of 21 october 2026: a fix commit exists (lasso, fix-5b91) but no published release contains it (pypi-ik); no exploitation is reported (lasso security lists "known exploit: no").
Show the change
Before: Provisional (no maintainer advisory or fix in the sources; no exploitation reported)
After: Provisional (no maintainer advisory; fix committed 5 July 2026 but not in a published release; no exploitation reported)
2026-10-21: Provenance tier text. Found in the editor's source check of 21 october 2026: the cited lasso security page names fix commit 5b91da57 (lasso); the commit is on intentkit's main branch dated 5 july 2026 (fix-5b91); no release after 2.6.3 is on the python package index (pypi-ik). no maintainer advisory was found.
Show the change
Before: CVE record assigned by VulnCheck and recorded in NVD, with a Lasso Security technical description; no maintainer advisory or fix found in the sources
After: CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no published IntentKit release contains it as of 21 October 2026
2026-10-21: Title. Found in the editor's source check of 21 october 2026: lasso security's page (lasso) names a fix: "upgrade to the first intentkit release that includes commit 5b91da57. until one is published, build from main at or after that commit." the maintainer's commit 5b91da57 is dated 5 july 2026 (fix-5b91); the newest release on the python package index is still 2.6.3 of 14 june 2026 (pypi-ik). what holds is that no fixed version is named.
Show the change
Before: IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; CVE published 15 October 2026, no fix named
After: IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no published release, CVE published 15 October 2026

Record history · 6 entries

2026-10-22: Right of reply offered to IntentKit.
2026-10-21: Source added: intentkit/tools/cdp/schema.json at tag v2.6.3 ('Wallet Operations' toolset, IntentKit repository).
2026-10-21: Source added: intentkit release history (Python Package Index).
2026-10-21: Source added: Release v2.9.0 (IntentKit CHANGELOG.md on main).
2026-10-21: Source added: feat: team_only tool marker replaces the guest/team dual tool lists (IntentKit commit 5b91da57).
2026-10-21: Source added: IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck).

Controls that address what went wrong

4 controls missing or failed. The line under each is the concrete form it would have taken in this case.

Machine-enforceable scope

Mechanism: the per-request narrowing of tools existed only in what was advertised to the model, while the executor accepted any tool in the full registry. Why it interrupts: if the narrowed tool set were enforced at execution, a call naming a de-advertised tool would be rejected however it reached the executor. Source shows it failed: the record says the executor validates against the full registry rather than the narrowed advertisement.

Failed on the available record · Mandate layer

Authority binding

Mechanism: tools restricted to the owner ran for a public, non-owner caller. Why it interrupts: binding each owner-only tool to the owner principal at execution would refuse the call from any other caller. Source shows it failed: the records say non-owner and unauthenticated callers can run owner-only tools.

Failed on the available record · Actor layer

Retrieved content as data

Failed: Mechanism: the record names indirect prompt injection as one route by which an attacker supplies the de-advertised tool name and arguments. Why it interrupts: if read content were never treated as instruction, that route could not produce the tool call (the history-replay route is unaffected). Source shows it failed only by naming the route. the counterfactual is not shown.

Failed on the available record · Inputs layer

Destructive-action gate

Mechanism: state-changing tools including wallet transfer executed with no confirmation step. Why it interrupts: a confirmation or threshold on transfers and posts would put a human decision between the injected call and the effect. Source shows it absent: the record says the tools execute without any human-in-the-loop or approval gate.

Missing on the available record · Envelope layer

New cases like this, once a week. A short email when a case, signal or rule touches agents moving money. Free; unsubscribe in one click.

Get the weekly email

How it unfolded, layer by layer

MandateWhat it was told to do

Who deployed it: The agent's owner, to whom state-changing tools such as wallet transfer, posting, memory-write and call-agent are restricted. The task: not evidenced in source.

Failed: Machine-enforceable scope

ActorWhat acted

An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it

Failed: Authority binding

InputsWhat it could see

A tool call naming a de-advertised owner-only tool and its arguments, supplied by an unauthenticated or public caller in WEB, API, TWITTER or TELEGRAM contexts through indirect prompt injection, or by replaying checkpoint and history data on a reused thread

Failed: Retrieved content as data

DecisionHow it chose

The executor validates the tool call against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, and accepts it

EnvelopeWhat it was allowed to do

Limits in place: Tool permissions are enforced only in the list of tools shown to the model; the executor is built from the full private tool set, and no approval step applies to these tools.

Absent: Destructive-action gate

ActionWhat it did

Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate

OutcomeWhat happened

Pending. Severity: none reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred).

EvidenceWhat can be proven

Record of the event: CVE-2026-76066, assigned by VulnCheck as CVE Numbering Authority (reserved 18 August 2026; public date given as 12 October 2026; record published 15 October 2026), weakness CWE-862 Missing Authorization (CWE: Common Weakness Enumeration), VulnCheck severity scores of 8.7 on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5 on CVSS version 3.1; affected versions through 2.6.3; finders credited as Noy Pearl, Michael Sromin and Ophir Dror. On 15 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added an assessment rating exploitation as proof of concept ('poc') and automatable.

RecoveryWhat could be stopped, undone, answered for

Technical recovery: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix. Accountability: not evidenced in source.

The same gap in other cases

Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.

Control	Same world	Other worlds
Machine-enforceable scope	The DAO 2016	PocketOS 2026 (software agents), Replit and SaaStr 2025 (software agents), Benavides v. Tesla 2025 (machines), UK AI Security Institute: agents in a… (software agents), LangAlpha: instructions planted in web… (software agents), piflow: anyone who can reach the… (software agents), Vibe-Trading: instructions planted in… (software agents)
Authority binding	·	OpenAI agent, Medicare portal 2026 (software agents), Kia dealer portal 2024 (machines), Gemini calendar invite 2025 (software acting on machines), Model Context Protocol (MCP) TypeScript… (software agents)
Retrieved content as data	·	GitHub MCP leak 2025 (software agents), EchoLeak 2025 (software agents), Gemini calendar invite 2025 (software acting on machines), Claude Code [bot] trust 2026 (software agents), Perplexity Comet 2025 (software agents), Roo Code: crafted shell commands pass the… (software agents), OpenSRE: instructions planted in alerts or… (software agents), LangAlpha: instructions planted in web… (software agents), Vibe-Trading: instructions planted in… (software agents)
Destructive-action gate	·	PocketOS 2026 (software agents), Replit and SaaStr 2025 (software agents), Triton 2017 (machines), Gemini calendar invite 2025 (software acting on machines), Pydantic AI: a web page can make a… (software agents), Archon: control API (application… (software agents), destructive_command_guard: a crafted… (software agents), OpenSRE: instructions planted in alerts or… (software agents), LangAlpha: instructions planted in web… (software agents), piflow: anyone who can reach the… (software agents), Vibe-Trading: instructions planted in… (software agents)

Cost and accountability

Severitynone reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred)

AffectedNot recorded

Costnone reported

Regulatory or legal consequencenone

Technical recoveryTechnical recovery: No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix.

Accountabilitynot evidenced in source

InterpretationWhy it matters beyond its domain. In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no release on the Python Package Index contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled. Signed by Saurabh Bhatnagar on 2026-10-22.

Right of reply

Named party	Status
IntentKit	Offered 2026-10-22; awaiting response	Respond for IntentKit