{
 "schema_version": "0.4",
 "id": "REG-0031",
 "title": "IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no release on the Python Package Index, CVE published 15 October 2026",
 "batch": "agent-2026-10-15",
 "family": "transaction",
 "context": {
  "domain": "Software agent (framework for autonomous agents that hold a wallet and act on web, API, Twitter and Telegram channels)",
  "autonomy_level": "alone",
  "autonomy_level_text": "Owner-only state-changing tools execute with no human-in-the-loop or approval gate",
  "actor_type": "Software: an agent built on IntentKit through 2.6.3",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as a public or unauthenticated caller, through indirect prompt injection or replayed thread history",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported",
  "jurisdiction": [
   "Global (open-source framework)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_uncorroborated",
 "provenance_tier_text": "CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no IntentKit release on the Python Package Index contains it as of 21 October 2026",
 "status": "provisional",
 "status_text": "Provisional (no maintainer advisory; fix committed 5 July 2026 but in no release on the Python Package Index; no exploitation reported)",
 "outcome": {
  "state": "pending",
  "severity": "none reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred)",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "21 Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "The agent's owner, to whom state-changing tools such as wallet transfer, posting, memory-write and call-agent are restricted",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-76066"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066",
    "LASSO",
    "SCHEMA-263"
   ],
   "confidence": "medium",
   "disputed": true
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "A tool call naming a de-advertised owner-only tool and its arguments, supplied by an unauthenticated or public caller in WEB, API, TWITTER or TELEGRAM contexts through indirect prompt injection, or by replaying checkpoint and history data on a reused thread",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The executor validates the tool call against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, and accepts it",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066",
    "LASSO"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "Tool permissions are enforced only in the list of tools shown to the model; the executor is built from the full private tool set, and no approval step applies to these tools",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066",
    "LASSO"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-76066"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: pending (no release on the Python Package Index contains the fix). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-76066",
    "LASSO",
    "CVE-76066"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "CVE-2026-76066, assigned by VulnCheck as CVE Numbering Authority (reserved 18 August 2026; public date given as 12 October 2026; record published 15 October 2026), weakness CWE-862 Missing Authorization (CWE: Common Weakness Enumeration), VulnCheck severity scores of 8.7 on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5 on CVSS version 3.1; affected versions through 2.6.3; finders credited as Noy Pearl, Michael Sromin and Ophir Dror. On 15 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added an assessment rating exploitation as proof of concept ('poc') and automatable",
   "assertion_type": "fact",
   "source_ids": [
    "CVE-ORG",
    "NVD-76066",
    "LASSO",
    "CVE-76066"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix",
   "assertion_type": "fact",
   "source_ids": [
    "CVE-ORG",
    "NVD-76066",
    "LASSO",
    "FIX-5B91",
    "CHANGELOG-IK",
    "PYPI-IK"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-76066",
    "LASSO",
    "CVE-76066"
   ],
   "confidence": "low",
   "disputed": false
  }
 ],
 "inference": {
  "value": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no release on the Python Package Index contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
  "source_ids": [
   "NVD-76066",
   "LASSO",
   "FIX-5B91",
   "PYPI-IK",
   "SCHEMA-263"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-22"
 },
 "controls": {
  "failed": [
   {
    "id": "C-M2",
    "note": "Mechanism: the per-request narrowing of tools existed only in what was advertised to the model, while the executor accepted any tool in the full registry. Why it interrupts: if the narrowed tool set were enforced at execution, a call naming a de-advertised tool would be rejected however it reached the executor. Source shows it failed: the record says the executor validates against the full registry rather than the narrowed advertisement.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-A2",
    "note": "Mechanism: tools restricted to the owner ran for a public, non-owner caller. Why it interrupts: binding each owner-only tool to the owner principal at execution would refuse the call from any other caller. Source shows it failed: the records say non-owner and unauthenticated callers can run owner-only tools.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-I1",
    "note": "Mechanism: the record names indirect prompt injection as one route by which an attacker supplies the de-advertised tool name and arguments. Why it interrupts: if read content were never treated as instruction, that route could not produce the tool call (the history-replay route is unaffected). Source shows it failed only by naming the route; the counterfactual is not shown.",
    "confidence": "medium",
    "basis": "agent"
   }
  ],
  "succeeded": [],
  "absent": [
   {
    "id": "C-E3",
    "note": "Mechanism: state-changing tools including wallet transfer executed with no confirmation step. Why it interrupts: a confirmation or threshold on transfers and posts would put a human decision between the injected call and the effect. Source shows it absent: the record says the tools execute without any human-in-the-loop or approval gate.",
    "confidence": "medium",
    "basis": "agent"
   }
  ]
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "IntentKit",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null,
    "channel": "GitHub private vulnerability report GHSA-hh28-c992-c8h2 on crestalnetwork/intentkit (visible to the maintainers only)"
   }
  }
 ],
 "sources": {
  "NVD-76066": {
   "title": "NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76066",
   "date": "2026-10-15",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "LASSO": {
   "title": "CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database)",
   "type": "researcher",
   "url": "https://www.lasso.security/vulnerability-database/cve-2026-76066",
   "date": "2026-10-15",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "CVE-76066": {
   "title": "CVE record CVE-2026-76066 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-862, affected range, credits",
   "type": "public_record",
   "url": "https://cve.threatint.com/CVE/CVE-2026-76066",
   "date": "2026-10-15",
   "tier": "public_regulatory",
   "interest": null,
   "primary": false,
   "checked": "2026-10-21"
  },
  "CVE-ORG": {
   "title": "IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck)",
   "type": "public_record",
   "url": "https://www.cve.org/CVERecord?id=CVE-2026-76066",
   "date": "2026-10-15",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "FIX-5B91": {
   "title": "feat: team_only tool marker replaces the guest/team dual tool lists (IntentKit commit 5b91da57)",
   "type": "company",
   "url": "https://github.com/crestalnetwork/intentkit/commit/5b91da5734d1ac16cd656fa66a86caf8f15cd671",
   "date": "2026-07-05",
   "tier": "company",
   "interest": "maintainer describing its own change",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "CHANGELOG-IK": {
   "title": "Release v2.9.0 (IntentKit CHANGELOG.md on main)",
   "type": "company",
   "url": "https://github.com/crestalnetwork/intentkit/blob/main/CHANGELOG.md",
   "date": "2026-07-06",
   "tier": "company",
   "interest": "maintainer describing its own release",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "PYPI-IK": {
   "title": "intentkit release history (Python Package Index)",
   "type": "public_record",
   "url": "https://pypi.org/project/intentkit/#history",
   "date": "2026-06-14",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "SCHEMA-263": {
   "title": "intentkit/tools/cdp/schema.json at tag v2.6.3 ('Wallet Operations' toolset, IntentKit repository)",
   "type": "company",
   "url": "https://github.com/crestalnetwork/intentkit/blob/v2.6.3/intentkit/tools/cdp/schema.json",
   "date": "2026-06-14",
   "tier": "company",
   "interest": "maintainer's own code",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "title",
   "old": "IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; CVE published 15 October 2026, no fix named",
   "new": "IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no published release, CVE published 15 October 2026",
   "reason": "Found in the editor's source check of 21 October 2026: Lasso Security's page (LASSO) names a fix: \"Upgrade to the first IntentKit release that includes commit 5b91da57. Until one is published, build from main at or after that commit.\" The maintainer's commit 5b91da57 is dated 5 July 2026 (FIX-5B91); the newest release on the Python Package Index is still 2.6.3 of 14 June 2026 (PYPI-IK). What holds is that no fixed version is named."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier_text",
   "old": "CVE record assigned by VulnCheck and recorded in NVD, with a Lasso Security technical description; no maintainer advisory or fix found in the sources",
   "new": "CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no published IntentKit release contains it as of 21 October 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the cited Lasso Security page names fix commit 5b91da57 (LASSO); the commit is on IntentKit's main branch dated 5 July 2026 (FIX-5B91); no release after 2.6.3 is on the Python Package Index (PYPI-IK). No maintainer advisory was found."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (no maintainer advisory or fix in the sources; no exploitation reported)",
   "new": "Provisional (no maintainer advisory; fix committed 5 July 2026 but not in a published release; no exploitation reported)",
   "reason": "Found in the editor's source check of 21 October 2026: a fix commit exists (LASSO, FIX-5B91) but no published release contains it (PYPI-IK); no exploitation is reported (Lasso Security lists \"Known exploit: No\")."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 4.0 8.7; CVSS 3.1 7.5)",
   "new": "none reported (severity scores assigned by VulnCheck, the CVE Numbering Authority: 8.7, High, on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5, High, on CVSS version 3.1; the National Vulnerability Database lists both as VulnCheck's and has not scored the flaw itself, status Deferred)",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (CVE-ORG) gives VulnCheck's scores, CVSS 4.0 base score 8.7 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) and CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); the National Vulnerability Database record (NVD-76066) lists both with source disclosure@vulncheck.com, type Secondary, and vulnStatus Deferred. The case did not say who assigned the scores or spell out CVSS."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-76066; no fixed version named",
   "new": "CVE-2026-76066 (record published 15 October 2026); no fixed version named; Lasso Security names commit 5b91da57 as the fix, which no published release contains as of 21 October 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record lists affected versions up to and including 2.6.3 with no fixed version (CVE-ORG), but Lasso Security names fix commit 5b91da57 (LASSO); the newest Python Package Index release is 2.6.3 (PYPI-IK)."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.as_of",
   "old": "Oct 2026",
   "new": "21 Oct 2026",
   "reason": "Found in the editor's source check of 21 October 2026: fix and release status re-checked on 21 October 2026 against the IntentKit repository (FIX-5B91, CHANGELOG-IK) and the Python Package Index (PYPI-IK)."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Actor",
   "old": "{\"value\": \"An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents, whose tool set always includes a wallet transfer tool\", \"source_ids\": [\"NVD-76066\", \"LASSO\"], \"confidence\": \"high\", \"disputed\": false}",
   "new": "{\"value\": \"An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it\", \"source_ids\": [\"NVD-76066\", \"LASSO\", \"SCHEMA-263\"], \"confidence\": \"medium\", \"disputed\": true}",
   "reason": "Found in the editor's source check of 21 October 2026: Lasso Security says \"cdp_native_transfer is one of the always-present system tools folded into every agent's private superset\" (LASSO), but the maintainer's file intentkit/tools/cdp/schema.json at tag v2.6.3 (SCHEMA-263) defines the 'Wallet Operations' toolset with \"enabled\" defaulting to false and cdp_native_transfer defaulting to \"disabled\", and the 2.6.3 system tools contain no wallet tool. The CVE record does not say the tool is always present. Both accounts stated; marked disputed; confidence lowered to medium."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.value",
   "old": "Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, execute for a non-owner caller without any human-in-the-loop or approval gate",
   "new": "Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (NVD-76066, CVE-ORG) describes what the flaw allows (\"allowing owner-only state-changing tools ... to execute\"); no source reports such an execution outside a test, so the present-tense \"execute\" is changed to \"can execute\"."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome.value",
   "old": "State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026.",
   "new": "State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: Lasso Security's page (LASSO) lists \"Known exploit: No\" and describes \"A local harness reusing IntentKit's wiring\" with \"a benign id canary standing in for an owner transfer\"; the case did not say the flaw was demonstrated. Date moved with outcome.as_of."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "{\"value\": \"CVE-2026-76066, assigned by VulnCheck (reserved 18 August 2026, published 15 October 2026), CWE-862 Missing Authorization, CVSS 4.0 8.7 and CVSS 3.1 7.5; affected versions through 2.6.3; credited to Noy Pearl, Michael Sromin and Ophir Dror\", \"source_ids\": [\"NVD-76066\", \"LASSO\", \"CVE-76066\"]}",
   "new": "{\"value\": \"CVE-2026-76066, assigned by VulnCheck as CVE Numbering Authority (reserved 18 August 2026; public date given as 12 October 2026; record published 15 October 2026), weakness CWE-862 Missing Authorization (CWE: Common Weakness Enumeration), VulnCheck severity scores of 8.7 on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5 on CVSS version 3.1; affected versions through 2.6.3; finders credited as Noy Pearl, Michael Sromin and Ophir Dror. On 15 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added an assessment rating exploitation as proof of concept ('poc') and automatable\", \"source_ids\": [\"CVE-ORG\", \"NVD-76066\", \"LASSO\", \"CVE-76066\"]}",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (CVE-ORG, read from the CVE Services copy) gives dateReserved 2026-08-18, datePublic 2026-10-12 and datePublished 2026-10-15, credits the three finders, and carries a CISA ADP (Authorized Data Publisher) Vulnrichment entry of 15 October 2026 with SSVC values Exploitation \"poc\", Automatable \"yes\", Technical Impact \"partial\". The case omitted the public date, the scores' assigner and the CISA assessment, and did not spell out CVSS or CWE."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "{\"value\": \"No fixed version is named in the records; a CVE mirror states patch status is not confirmed\", \"source_ids\": [\"NVD-76066\", \"LASSO\", \"CVE-76066\"]}",
   "new": "{\"value\": \"No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes those tools re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix\", \"source_ids\": [\"CVE-ORG\", \"NVD-76066\", \"LASSO\", \"FIX-5B91\", \"CHANGELOG-IK\", \"PYPI-IK\"]}",
   "reason": "Found in the editor's source check of 21 October 2026: the ThreatINT mirror (CVE-76066), read on 21 October 2026, contains no patch-status wording, so the claim that it \"states patch status is not confirmed\" is removed. Lasso Security (LASSO) names fix commit 5b91da57; the commit (FIX-5B91) says \"ToolBindingMiddleware drops team_only tools per request when a guest ... is talking; each marked tool re-checks at execution time\"; the changelog (CHANGELOG-IK) says owner actions are \"enforced both when tools are offered and again when they execute\" under Release v2.9.0; the Python Package Index (PYPI-IK) shows 2.6.3 (14 June 2026) as the latest release and no 2.9.0."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Hiding a tool from the model is not an authorization check: when the executor trusts the full registry, any caller who can name the tool, by injection or replay, holds the owner's authority, including over the wallet.",
   "new": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes such tools re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
   "reason": "Found in the editor's source check of 21 October 2026: the previous reading said \"any caller who can name the tool ... holds the owner's authority, including over the wallet\", which goes beyond the record: the CVE record and Lasso Security (NVD-76066, LASSO) describe owner-only tools enabled on the agent, and whether the wallet transfer tool is present by default is disputed (LASSO against SCHEMA-263). It also did not say what the record does not show. The fix commit (FIX-5B91) and release status (PYPI-IK) are added. The interpretation was unsigned."
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"NVD-76066\", \"LASSO\"]",
   "new": "[\"NVD-76066\", \"LASSO\", \"FIX-5B91\", \"PYPI-IK\", \"SCHEMA-263\"]",
   "reason": "Found in the editor's source check of 21 October 2026: sources for the fix, release status and wallet-tool default added to the interpretation."
  },
  {
   "date": "2026-10-21",
   "field": "sources.LASSO.title",
   "old": "Lasso Security vulnerability database, CVE-2026-76066: Tool Visibility Not Enforced at Execution (crestalnetwork/intentkit)",
   "new": "CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database)",
   "reason": "Found in the editor's source check of 21 October 2026: the page's main heading is \"CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode\" (HTML title \"CVE-2026-76066: IntentKit Tool Authorization Bypass\"); the phrase \"Tool Visibility Not Enforced at Execution\" does not appear on the page."
  },
  {
   "date": "2026-10-21",
   "field": "sources.CVE-ORG",
   "old": null,
   "new": "{\"title\": \"IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck)\", \"type\": \"public_record\", \"url\": \"https://www.cve.org/CVERecord?id=CVE-2026-76066\", \"date\": \"2026-10-15\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the canonical CVE record, read from the CVE Services copy at https://cveawg.mitre.org/api/cve/CVE-2026-76066, is the primary record for the dates, scores, credits and CISA assessment; the case cited only a mirror."
  },
  {
   "date": "2026-10-21",
   "field": "sources.FIX-5B91",
   "old": null,
   "new": "{\"title\": \"feat: team_only tool marker replaces the guest/team dual tool lists (IntentKit commit 5b91da57)\", \"type\": \"company\", \"url\": \"https://github.com/crestalnetwork/intentkit/commit/5b91da5734d1ac16cd656fa66a86caf8f15cd671\", \"date\": \"2026-07-05\", \"tier\": \"company\", \"interest\": \"maintainer describing its own change\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's commit named as the fix by Lasso Security, read in a clone of github.com/crestalnetwork/intentkit; dated 5 July 2026."
  },
  {
   "date": "2026-10-21",
   "field": "sources.CHANGELOG-IK",
   "old": null,
   "new": "{\"title\": \"Release v2.9.0 (IntentKit CHANGELOG.md on main)\", \"type\": \"company\", \"url\": \"https://github.com/crestalnetwork/intentkit/blob/main/CHANGELOG.md\", \"date\": \"2026-07-06\", \"tier\": \"company\", \"interest\": \"maintainer describing its own release\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's changelog on main lists the change under Release v2.9.0 (release-notes commit df31bbcb, 6 July 2026)."
  },
  {
   "date": "2026-10-21",
   "field": "sources.PYPI-IK",
   "old": null,
   "new": "{\"title\": \"intentkit release history (Python Package Index)\", \"type\": \"public_record\", \"url\": \"https://pypi.org/project/intentkit/#history\", \"date\": \"2026-06-14\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: release history read from https://pypi.org/pypi/intentkit/json: latest version 2.6.3, uploaded 14 June 2026; version 2.9.0 not found."
  },
  {
   "date": "2026-10-21",
   "field": "sources.SCHEMA-263",
   "old": null,
   "new": "{\"title\": \"intentkit/tools/cdp/schema.json at tag v2.6.3 ('Wallet Operations' toolset, IntentKit repository)\", \"type\": \"company\", \"url\": \"https://github.com/crestalnetwork/intentkit/blob/v2.6.3/intentkit/tools/cdp/schema.json\", \"date\": \"2026-06-14\", \"tier\": \"company\", \"interest\": \"maintainer's own code\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's 2.6.3 code shows the wallet transfer tool in an optional toolset that is off by default, which disputes Lasso Security's 'always-present' statement."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes such tools re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
   "new": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the fix re-checks only the tools it keeps for the owning team ('reserved for the owning team, enforced ... again when they execute', changelog, Release v2.9.0; code at commit 5b91da57); it opens some tools the CVE lists as owner-only to guests."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes those tools re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix",
   "new": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: same as the interpretation: the fix re-checks only the tools it keeps for the owning team (changelog, Release v2.9.0; commit 5b91da57)."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.state",
   "old": "averted_by_disclosure",
   "new": "pending",
   "reason": "Editor's call H1 of 21 October 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "new": "State: pending (the fix is not in any published release). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "reason": "Follows the editor's call H1 of 21 October 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged."
  },
  {
   "date": "2026-10-22",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-76066 (record published 15 October 2026); no fixed version named; Lasso Security names commit 5b91da57 as the fix, which no published release contains as of 21 October 2026",
   "new": "none",
   "reason": "Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a CVE, an advisory, a score or a fix is not one. The CVE and fix details are already in the Evidence and Recovery fields, so nothing is lost. Found while drafting this case's letters, 22 October 2026."
  },
  {
   "date": "2026-10-22",
   "field": "title",
   "old": "IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no published release, CVE published 15 October 2026",
   "new": "IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no release on the Python Package Index, CVE published 15 October 2026",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: the case's own changelog source lists the fix under 'Release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the Python Package Index is 2.6.3 (14 June 2026), and the public repository has no tag after v2.6.3. 'No published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the Python Package Index (https://pypi.org/project/intentkit/, read 22 October 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: pending (the fix is not in any published release). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "new": "State: pending (no release on the Python Package Index contains the fix). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026.",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: the case's own changelog source lists the fix under 'Release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the Python Package Index is 2.6.3 (14 June 2026), and the public repository has no tag after v2.6.3. 'No published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the Python Package Index (https://pypi.org/project/intentkit/, read 22 October 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no published release contains the fix",
   "new": "No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: the case's own changelog source lists the fix under 'Release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the Python Package Index is 2.6.3 (14 June 2026), and the public repository has no tag after v2.6.3. 'No published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the Python Package Index (https://pypi.org/project/intentkit/, read 22 October 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "inference.value",
   "old": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no published release contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
   "new": "In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no release on the Python Package Index contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: the case's own changelog source lists the fix under 'Release v2.9.0', and the changelog on main has release headings up to v2.42.0, apparently cut in a private fork; what the sources show is narrower: the newest release on the Python Package Index is 2.6.3 (14 June 2026), and the public repository has no tag after v2.6.3. 'No published release' could be read as contradicting the maintainer's own changelog, so the claim is narrowed to the Python Package Index (https://pypi.org/project/intentkit/, read 22 October 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "inference.signed_by",
   "old": "Saurabh Bhatnagar",
   "new": null,
   "reason": "The interpretation's wording changed after the editor signed it (independent re-read of 22 October 2026); the signature is cleared so the editor signs the corrected wording."
  },
  {
   "date": "2026-10-22",
   "field": "status_text",
   "old": "Provisional (no maintainer advisory; fix committed 5 July 2026 but not in a published release; no exploitation reported)",
   "new": "Provisional (no maintainer advisory; fix committed 5 July 2026 but in no release on the Python Package Index; no exploitation reported)",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: same narrowing as the title and Outcome field (the maintainer's changelog lists the fix under 'Release v2.9.0'; the Python Package Index's newest release is 2.6.3)."
  },
  {
   "date": "2026-10-22",
   "field": "provenance_tier_text",
   "old": "CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no published IntentKit release contains it as of 21 October 2026",
   "new": "CVE (Common Vulnerabilities and Exposures) record assigned by VulnCheck and recorded in the National Vulnerability Database (NVD), with a Lasso Security technical description; no maintainer advisory found. Lasso Security names maintainer commit 5b91da57 (5 July 2026) as the fix; no IntentKit release on the Python Package Index contains it as of 21 October 2026",
   "reason": "Found in the second independent re-read of 22 October 2026: same narrowing as the title and Outcome field (https://pypi.org/project/intentkit/, newest release 2.6.3 of 14 June 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[IntentKit].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-15",
 "last_reviewed": "2026-10-22",
 "reviewed_by": null,
 "derived_by": "agent"
}