{
 "schema_version": "0.4",
 "id": "REG-0035",
 "title": "OpenSRE: instructions planted in alerts or Slack messages make the AI SRE agent run shell commands on its host, because the approval check in headless mode always allows execution; CVE published 20 October 2026",
 "batch": "agent-2026-10-20",
 "family": "software",
 "context": {
  "domain": "Software agent (AI site-reliability agent that triages alerts and Slack messages and can run shell commands)",
  "autonomy_level": "alone",
  "autonomy_level_text": "In headless mode the agent's shell_run commands execute without confirmation: the approval check always returns True, so no person decides the command",
  "actor_type": "Software: the OpenSRE agent, through 0.1.2026.10.19",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as the author of alert or Slack text the agent triages",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure with a proof of concept the reporters ran in their own test setup; no exploitation in the wild reported",
  "jurisdiction": [
   "Global (open-source project)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "CVE record assigned by VulnCheck (the CVE Numbering Authority) and recorded in NVD, the US National Vulnerability Database (status Deferred on 21 October 2026); VulnCheck's advisory read; the reporters' technical advisory with a proof of concept is published by Lasso Security; the project's code at the cited commit shows the headless presenter returning True",
 "status": "confirmed",
 "status_text": "Confirmed (corroborated by the project's own code, which also disputes one point; no fix shipped as of 21 October 2026; proof of concept run by the reporters; no exploitation in the wild reported)",
 "outcome": {
  "state": "pending",
  "severity": "none reported (no harm reported; VulnCheck, the CVE Numbering Authority that assigned the identifier, rates the flaw 8.7, High, on CVSS 4.0 (the Common Vulnerability Scoring System, a 0 to 10 severity score) and 8.8, High, on CVSS 3.1; Lasso Security's entry shows a CVSS score of 9, Critical, without naming the version)",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "21 Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "Triage alerts and Slack messages (the record states the agent triages them)",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "OpenSRE through 0.1.2026.10.19, an open-source AI agent maintained by Tracer-Cloud (the vendor named in the CVE record) that triages alerts and Slack messages and has a shell_run tool",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Instructions injected into alerts or Slack messages that the agent triages",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The agent can act on the injected instructions and call shell_run; in headless mode the presenter's execution_allowed() always returns True, so the approval gate is bypassed",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "An approval gate on shell_run, which the headless presenter does not enforce (CWE-862, missing authorization). The accounts differ on whether shell_run opts into the gate: Lasso Security's write-up says shell_run never sets the approval flag (requires_approval), while the project's code at the affected commit 8eba8c9 (version 0.1.2026.10.19) marks shell_run requires_approval=True, a setting added on 6 October 2026 (commit ae5d449). Both accounts agree that on headless surfaces the presenter allows the command without asking",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444",
    "LASSO-109444",
    "REPO-SHELL-1019",
    "REPO-AE5D449"
   ],
   "confidence": "high",
   "disputed": true
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "The agent runs the attacker's commands on the host without confirmation, exposing LLM, Slack and cloud credentials to exfiltration",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: pending (no fix has shipped). No exploitation in the wild is reported in the sources; Lasso Security lists no known exploit. The reporters demonstrated the flaw in their own test setup: with a stubbed model, and with local models run through Ollama reading a forwarded Grafana alert carrying planted instructions, shell_run commands ran with no approval prompt (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel). Lasso Security reports that the injected command was persisted to the agent's cross-session memory, with automatic re-execution seen once and not reproduced, so unconfirmed. The CISA (Cybersecurity and Infrastructure Security Agency) enrichment of the CVE record marks exploitation as 'poc', a proof of concept. As of 21 October 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109444",
    "LASSO-109444"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "CVE-2026-109444 published 20 October 2026 by the VulnCheck CNA (CVE Numbering Authority); CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H), CVSS 3.1 8.8; CWE-862 (Common Weakness Enumeration: missing authorization); references OpenSRE source at commit 8eba8c9 (Slack dispatcher and subprocess_presenter.py), a VulnCheck advisory dated 19 October 2026 and Lasso Security's advisory; credits Noy Pearl, Michael Sromin and Ophir Dror as finders; gives 15 October 2026 as the date the flaw was made public. On 20 October 2026 CISA's enrichment of the record added Exploitation 'poc', Automatable 'yes', Technical Impact 'total'",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109444",
    "VC-109444"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "No fix had shipped as of 21 October 2026: the CVE record lists versions through 0.1.2026.10.19 as affected and names no fixed version, and in OpenSRE's code at version 0.1.2026.10.21, the latest tag on 21 October 2026, the headless presenter's execution_allowed() still returns True. Lasso Security recommends requiring approval for shell_run and cli_exec, failing closed on headless surfaces when no approver is available, and treating observability content as untrusted data",
   "assertion_type": "assertion",
   "source_ids": [
    "LASSO-109444",
    "NVD-109444",
    "REPO-PRESENTER-1021"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109444"
   ],
   "confidence": "low",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() always returns True, allowing the command, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this with a planted alert in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
  "source_ids": [
   "NVD-109444",
   "LASSO-109444",
   "REPO-PRESENTER-1021"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [
   {
    "id": "C-E3",
    "note": "Mechanism: shell_run is meant to require confirmation (the project's code at the affected commit marks it requires_approval=True; Lasso Security's write-up says it never opted into the gate), but in headless mode the presenter's execution_allowed() always returns True, so commands the agent derives from injected alert or Slack text run without confirmation. Why it interrupts: a confirmation step that is enforced on every surface would put a human decision between the injected instruction and the host command. Source shows it failed: the record calls this an approval gate bypass and states commands run without confirmation.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-D2",
    "note": "Mechanism: when no human approver is present (the headless presenter), the presenter's code allows the command rather than stopping. Why it interrupts: stopping and handing off when the approval cannot be obtained would have blocked the command even with the injected instruction accepted. Source shows it failed: execution_allowed() always returns True in headless mode. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown.",
    "confidence": "medium",
    "basis": "agent"
   },
   {
    "id": "C-I1",
    "note": "Mechanism: the record names injected instructions in alerts or Slack messages, which the agent reads while triaging, as the route to command execution. Why it interrupts: if text read during triage were treated only as data, the planted instruction would not become a shell_run call. Source shows it failed: the agent acts on instructions planted in the content it triages.",
    "confidence": "medium",
    "basis": "agent"
   }
  ],
  "succeeded": [],
  "absent": []
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "OpenSRE",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null
   }
  }
 ],
 "sources": {
  "NVD-109444": {
   "title": "NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109444",
   "date": "2026-10-20",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "LASSO-109444": {
   "title": "Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection'",
   "type": "researcher",
   "url": "https://www.lasso.security/vulnerability-database/cve-2026-109444",
   "date": null,
   "tier": "researcher",
   "interest": "Security vendor that publishes the entry and sells AI security products",
   "primary": true,
   "checked": "2026-10-21"
  },
  "VC-109444": {
   "title": "VulnCheck advisory, 'OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection'",
   "type": "researcher",
   "url": "https://www.vulncheck.com/advisories/opensre-through-0.1.2026.10.19-approval-gate-bypass-via-shell-run-prompt-injection",
   "date": "2026-10-19",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REPO-AE5D449": {
   "title": "Tracer-Cloud/opensre on GitHub: commit ae5d449, 'refactor(tools): tighten tool execution defaults (#6631)'",
   "type": "company",
   "url": "https://github.com/Tracer-Cloud/opensre/commit/ae5d4497b37197f696483b2a46dbe47a212eeba0",
   "date": "2026-10-06",
   "tier": "company",
   "interest": "maintainer's own repository",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REPO-SHELL-1019": {
   "title": "Tracer-Cloud/opensre on GitHub: tools/interactive_shell/actions/shell.py at commit 8eba8c9 (tag v0.1.2026.10.19), shell_run tool definition",
   "type": "company",
   "url": "https://github.com/Tracer-Cloud/opensre/blob/8eba8c9301fa954d9eecb1693b7e2021215ec2ec/tools/interactive_shell/actions/shell.py#L163",
   "date": "2026-10-19",
   "tier": "company",
   "interest": "maintainer's own repository",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REPO-PRESENTER-1021": {
   "title": "Tracer-Cloud/opensre on GitHub: tools/interactive_shell/subprocess_presenter.py at tag v0.1.2026.10.21",
   "type": "company",
   "url": "https://github.com/Tracer-Cloud/opensre/blob/v0.1.2026.10.21/tools/interactive_shell/subprocess_presenter.py#L41",
   "date": "2026-10-20",
   "tier": "company",
   "interest": "maintainer's own repository",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "sources.VC-109444",
   "old": null,
   "new": "{\"title\": \"VulnCheck advisory, 'OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection'\", \"type\": \"researcher\", \"url\": \"https://www.vulncheck.com/advisories/opensre-through-0.1.2026.10.19-approval-gate-bypass-via-shell-run-prompt-injection\", \"date\": \"2026-10-19\", \"tier\": \"researcher\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record's third-party advisory from VulnCheck, the CVE Numbering Authority that assigned CVE-2026-109444, which the drafting run could not open; it is dated 19 October 2026, gives CVSS 4.0 8.7 and credits Noy Pearl, Michael Sromin and Ophir Dror."
  },
  {
   "date": "2026-10-21",
   "field": "sources.REPO-AE5D449",
   "old": null,
   "new": "{\"title\": \"Tracer-Cloud/opensre on GitHub: commit ae5d449, 'refactor(tools): tighten tool execution defaults (#6631)'\", \"type\": \"company\", \"url\": \"https://github.com/Tracer-Cloud/opensre/commit/ae5d4497b37197f696483b2a46dbe47a212eeba0\", \"date\": \"2026-10-06\", \"tier\": \"company\", \"interest\": \"maintainer's own repository\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's commit of 6 October 2026 sets requires_approval=True on shell_run ('Shell and Python execution tools ask for approval on every surface'), which bears on Lasso Security's statement that shell_run never opts into the approval gate."
  },
  {
   "date": "2026-10-21",
   "field": "sources.REPO-SHELL-1019",
   "old": null,
   "new": "{\"title\": \"Tracer-Cloud/opensre on GitHub: tools/interactive_shell/actions/shell.py at commit 8eba8c9 (tag v0.1.2026.10.19), shell_run tool definition\", \"type\": \"company\", \"url\": \"https://github.com/Tracer-Cloud/opensre/blob/8eba8c9301fa954d9eecb1693b7e2021215ec2ec/tools/interactive_shell/actions/shell.py#L163\", \"date\": \"2026-10-19\", \"tier\": \"company\", \"interest\": \"maintainer's own repository\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's code at the commit the CVE record cites (8eba8c9, tag v0.1.2026.10.19) marks shell_run requires_approval=True with approval_reason 'Runs a command on this machine.'"
  },
  {
   "date": "2026-10-21",
   "field": "sources.REPO-PRESENTER-1021",
   "old": null,
   "new": "{\"title\": \"Tracer-Cloud/opensre on GitHub: tools/interactive_shell/subprocess_presenter.py at tag v0.1.2026.10.21\", \"type\": \"company\", \"url\": \"https://github.com/Tracer-Cloud/opensre/blob/v0.1.2026.10.21/tools/interactive_shell/subprocess_presenter.py#L41\", \"date\": \"2026-10-20\", \"tier\": \"company\", \"interest\": \"maintainer's own repository\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: later development: in version 0.1.2026.10.21 (tagged 20 October 2026) the headless presenter's execution_allowed() still returns True; the file is unchanged since commit 8eba8c9, so no fix had shipped as of 21 October 2026."
  },
  {
   "date": "2026-10-21",
   "field": "sources.LASSO-109444.title",
   "old": "Lasso Security vulnerability database entry CVE-2026-109444 (OpenSRE): no known exploit; injected command persisted to memory; remediation recommendations",
   "new": "Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection'",
   "reason": "Found in the editor's source check of 21 October 2026: the entry's exact headline is 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection' (Lasso Security page)."
  },
  {
   "date": "2026-10-21",
   "field": "sources.LASSO-109444.primary",
   "old": "false",
   "new": "true",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (CVE.org) links this entry as the 'Lasso.security Advisory', tagged 'technical-description' and 'exploit'; it is the reporters' own technical record with their proof of concept, a researcher primary record."
  },
  {
   "date": "2026-10-21",
   "field": "sources.LASSO-109444.interest",
   "old": "Security vendor that publishes the database entry",
   "new": "Security vendor that publishes the entry and sells AI security products",
   "reason": "Found in the editor's source check of 21 October 2026: the Lasso Security page closes by offering its automated AI red-teaming product ('Book a Demo')."
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-109444.checked; sources.LASSO-109444.checked",
   "old": "2026-10-20",
   "new": "2026-10-21",
   "reason": "Found in the editor's source check of 21 October 2026: both sources re-opened in this check (NVD record through the NVD API; Lasso Security page in full)."
  },
  {
   "date": "2026-10-21",
   "field": "context.mandate_context_text",
   "old": "Vulnerability disclosure; no exploitation reported",
   "new": "Vulnerability disclosure with a proof of concept the reporters ran in their own test setup; no exploitation in the wild reported",
   "reason": "Found in the editor's source check of 21 October 2026: Lasso Security's advisory describes a proof of concept run at three levels (code checks, a stubbed model, and local models through Ollama) in which commands ran with no approval prompt, and lists 'Known exploit: No'; the CISA enrichment of the CVE record marks exploitation as 'poc'."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier_text",
   "old": "CVE record assigned by VulnCheck (CNA) and recorded in NVD (status Received); the VulnCheck advisory it references could not be opened in this run; a Lasso Security database entry restates the flaw and reports no known exploit",
   "new": "CVE record assigned by VulnCheck (the CVE Numbering Authority) and recorded in NVD, the US National Vulnerability Database (status Deferred on 21 October 2026); VulnCheck's advisory read; the reporters' technical advisory with a proof of concept is published by Lasso Security; the project's code at the cited commit shows the headless presenter returning True",
   "reason": "Found in the editor's source check of 21 October 2026: the NVD record's status is now 'Deferred' (NVD API, last modified 20 October 2026 20:11); the VulnCheck advisory was opened in this check; the CVE record links Lasso Security's entry as the 'Lasso.security Advisory' with the proof of concept, so it is not only a restatement. The tier value itself is left to the editor."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (CNA advisory not read in this run; no fix named in the sources; no exploitation reported)",
   "new": "Provisional (no fix shipped as of 21 October 2026; proof of concept run by the reporters; no exploitation in the wild reported)",
   "reason": "Found in the editor's source check of 21 October 2026: the CNA advisory has now been read (VulnCheck); OpenSRE's code at tag v0.1.2026.10.21 still has execution_allowed() returning True; Lasso Security's advisory describes a working proof of concept. The status value is left to the editor."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 4.0 8.7)",
   "new": "none reported (no harm reported; VulnCheck, the CVE Numbering Authority that assigned the identifier, rates the flaw 8.7, High, on CVSS 4.0 (the Common Vulnerability Scoring System, a 0 to 10 severity score) and 8.8, High, on CVSS 3.1; Lasso Security's entry shows a CVSS score of 9, Critical, without naming the version)",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (CVE.org and NVD) gives both scores with VulnCheck as their source (NVD lists them as 'Secondary'): CVSS 4.0 8.7 High and CVSS 3.1 8.8 High; Lasso Security's entry shows 'CVSS Score 9', 'Critical', with no version named. The case gave one score without saying who assigned it."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.as_of",
   "old": "Oct 2026",
   "new": "21 Oct 2026",
   "reason": "Found in the editor's source check of 21 October 2026: later developments checked to 21 October 2026: CISA enrichment of the CVE record (20 October), NVD status Deferred, and versions 0.1.2026.10.20 and 0.1.2026.10.21 shipped without a fix (OpenSRE repository)."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Actor",
   "old": "OpenSRE through 0.1.2026.10.19, an AI agent that triages alerts and Slack messages and has a shell_run tool",
   "new": "OpenSRE through 0.1.2026.10.19, an open-source AI agent maintained by Tracer-Cloud (the vendor named in the CVE record) that triages alerts and Slack messages and has a shell_run tool",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record names the vendor as 'Tracer-Cloud' and the repository as github.com/Tracer-Cloud/opensre; the case did not name the maintainer."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Decision",
   "old": "The agent acts on the injected instructions and calls shell_run; in headless mode the presenter's execution_allowed() always returns True, so the approval gate is bypassed",
   "new": "The agent can act on the injected instructions and call shell_run; in headless mode the presenter's execution_allowed() always returns True, so the approval gate is bypassed",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record says attackers 'can inject instructions' to run commands; Lasso Security's tests show it depends on the model and run (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel), so 'acts on' overstated it."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints",
   "old": "{\"value\": \"An approval gate on shell_run, which the headless presenter does not enforce (CWE-862, missing authorization)\", \"source_ids\": [\"NVD-109444\"], \"disputed\": false}",
   "new": "{\"value\": \"An approval gate on shell_run, which the headless presenter does not enforce (CWE-862, missing authorization). The accounts differ on whether shell_run opts into the gate: Lasso Security's write-up says shell_run never sets the approval flag (requires_approval), while the project's code at the affected commit 8eba8c9 (version 0.1.2026.10.19) marks shell_run requires_approval=True, a setting added on 6 October 2026 (commit ae5d449). Both accounts agree that on headless surfaces the presenter allows the command without asking\", \"source_ids\": [\"NVD-109444\", \"LASSO-109444\", \"REPO-SHELL-1019\", \"REPO-AE5D449\"], \"disputed\": true}",
   "reason": "Found in the editor's source check of 21 October 2026: sources disagree. Lasso Security: 'OpenSRE has a human approval gate, but shell_run never opts into it'. OpenSRE's code at commit 8eba8c9, the commit the CVE record cites, sets 'requires_approval=True' on shell_run, added by commit ae5d449 on 6 October 2026. Both accounts are now stated and the field is marked disputed."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome",
   "old": "{\"value\": \"State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and reports that the injected command was persisted to the agent's memory, with re-execution unconfirmed. As of Oct 2026.\"}",
   "new": "{\"value\": \"State: averted by disclosure. No exploitation in the wild is reported in the sources; Lasso Security lists no known exploit. The reporters demonstrated the flaw in their own test setup: with a stubbed model, and with local models run through Ollama reading a forwarded Grafana alert carrying planted instructions, shell_run commands ran with no approval prompt (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel). Lasso Security reports that the injected command was persisted to the agent's cross-session memory, with automatic re-execution seen once and not reproduced, so unconfirmed. The CISA (Cybersecurity and Infrastructure Security Agency) enrichment of the CVE record marks exploitation as 'poc', a proof of concept. As of 21 October 2026.\"}",
   "reason": "Found in the editor's source check of 21 October 2026: Lasso Security's advisory describes a working proof of concept (stubbed model; local models through Ollama; commands ran with no approval prompt); the CISA enrichment added to the CVE record on 20 October 2026 gives Exploitation 'poc'. The case did not say the flaw had been demonstrated."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "{\"value\": \"CVE-2026-109444 published 20 October 2026 by the VulnCheck CNA; CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H), CVSS 3.1 8.8; CWE-862; references OpenSRE source at commit 8eba8c9 (Slack dispatcher and subprocess_presenter.py) and a VulnCheck advisory\", \"source_ids\": [\"NVD-109444\"]}",
   "new": "{\"value\": \"CVE-2026-109444 published 20 October 2026 by the VulnCheck CNA (CVE Numbering Authority); CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H), CVSS 3.1 8.8; CWE-862 (Common Weakness Enumeration: missing authorization); references OpenSRE source at commit 8eba8c9 (Slack dispatcher and subprocess_presenter.py), a VulnCheck advisory dated 19 October 2026 and Lasso Security's advisory; credits Noy Pearl, Michael Sromin and Ophir Dror as finders; gives 15 October 2026 as the date the flaw was made public. On 20 October 2026 CISA's enrichment of the record added Exploitation 'poc', Automatable 'yes', Technical Impact 'total'\", \"source_ids\": [\"NVD-109444\", \"VC-109444\"]}",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (CVE.org) also references the Lasso.security Advisory, credits three finders, and gives datePublic 15 October 2026; the VulnCheck advisory is dated 19 October 2026; the CISA ADP enrichment (20 October 2026 16:04 UTC) gives the exploitation, automatable and technical impact values."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "{\"value\": \"No fixed version is named in the sources. Lasso Security recommends requiring approval for shell_run and cli_exec, failing closed on headless surfaces when no approver is available, and treating observability content as untrusted data\", \"source_ids\": [\"LASSO-109444\"]}",
   "new": "{\"value\": \"No fix had shipped as of 21 October 2026: the CVE record lists versions through 0.1.2026.10.19 as affected and names no fixed version, and in OpenSRE's code at version 0.1.2026.10.21, the latest tag on 21 October 2026, the headless presenter's execution_allowed() still returns True. Lasso Security recommends requiring approval for shell_run and cli_exec, failing closed on headless surfaces when no approver is available, and treating observability content as untrusted data\", \"source_ids\": [\"LASSO-109444\", \"NVD-109444\", \"REPO-PRESENTER-1021\"]}",
   "reason": "Found in the editor's source check of 21 October 2026: later development: versions 0.1.2026.10.20 and 0.1.2026.10.21 were tagged without changing the headless presenter (OpenSRE repository, subprocess_presenter.py at tag v0.1.2026.10.21 still returns True)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "An approval gate that returns 'allowed' when no person is there to ask is not a gate; the headless path decided the outcome.",
   "new": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() returns 'allowed' every time, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: 'the headless path decided the outcome' named a single cause, while Lasso Security's advisory also describes model behaviour that varied by run, a shell policy that allows every command and a child process that inherits the full environment; the interpretation also did not say what the record does not show (no exploitation in the wild, memory re-execution unconfirmed, no fix by version 0.1.2026.10.21). It was unsigned, so no signature was cleared."
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-E3",
   "old": "Mechanism: shell_run is meant to require confirmation, but in headless mode the presenter's execution_allowed() always returns True, so commands the agent derives from injected alert or Slack text run without confirmation. Why it interrupts: a confirmation step that is enforced on every surface would put a human decision between the injected instruction and the host command. Source shows it failed: the record calls this an approval gate bypass and states commands run without confirmation.",
   "new": "Mechanism: shell_run is meant to require confirmation (the project's code at the affected commit marks it requires_approval=True; Lasso Security's write-up says it never opted into the gate), but in headless mode the presenter's execution_allowed() always returns True, so commands the agent derives from injected alert or Slack text run without confirmation. Why it interrupts: a confirmation step that is enforced on every surface would put a human decision between the injected instruction and the host command. Source shows it failed: the record calls this an approval gate bypass and states commands run without confirmation.",
   "reason": "Found in the editor's source check of 21 October 2026: sources disagree on whether shell_run opts into the approval gate: OpenSRE's code at commit 8eba8c9 sets requires_approval=True; Lasso Security says shell_run never opts in. Both accounts now stated."
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-D2",
   "old": "Mechanism: when no human approver is present (the headless presenter), the agent proceeds rather than stopping. Why it interrupts: stopping and handing off when the approval cannot be obtained would have blocked the command even with the injected instruction accepted. Source shows it failed: execution_allowed() always returns True in headless mode. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown.",
   "new": "Mechanism: when no human approver is present (the headless presenter), the presenter's code allows the command rather than stopping. Why it interrupts: stopping and handing off when the approval cannot be obtained would have blocked the command even with the injected instruction accepted. Source shows it failed: execution_allowed() always returns True in headless mode. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown.",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record and OpenSRE's code describe a code path (the headless presenter's execution_allowed() returns True), not the agent choosing to proceed."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() returns 'allowed' every time, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
   "new": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() always returns True, allowing the command, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: 'allowed' is not the function's value: the CVE record says it 'always returns True', and the code at tag v0.1.2026.10.21 has 'return True'."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() always returns True, allowing the command, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
   "new": "The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() always returns True, allowing the command, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this with a planted alert in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the reporters' proof of concept used a planted Grafana alert only, not a Slack message (Lasso Security, CVE-2026-109444, proof-of-concept step 3)."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.state",
   "old": "averted_by_disclosure",
   "new": "pending",
   "reason": "Editor's call H1 of 21 October 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier",
   "old": "disclosure_uncorroborated",
   "new": "disclosure_corroborated",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism."
  },
  {
   "date": "2026-10-21",
   "field": "status",
   "old": "provisional",
   "new": "confirmed",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (no fix shipped as of 21 October 2026; proof of concept run by the reporters; no exploitation in the wild reported)",
   "new": "Confirmed (corroborated by the project's own code, which also disputes one point; no fix shipped as of 21 October 2026; proof of concept run by the reporters; no exploitation in the wild reported)",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation in the wild is reported in the sources; Lasso Security lists no known exploit. The reporters demonstrated the flaw in their own test setup: with a stubbed model, and with local models run through Ollama reading a forwarded Grafana alert carrying planted instructions, shell_run commands ran with no approval prompt (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel). Lasso Security reports that the injected command was persisted to the agent's cross-session memory, with automatic re-execution seen once and not reproduced, so unconfirmed. The CISA (Cybersecurity and Infrastructure Security Agency) enrichment of the CVE record marks exploitation as 'poc', a proof of concept. As of 21 October 2026.",
   "new": "State: pending (no fix has shipped). No exploitation in the wild is reported in the sources; Lasso Security lists no known exploit. The reporters demonstrated the flaw in their own test setup: with a stubbed model, and with local models run through Ollama reading a forwarded Grafana alert carrying planted instructions, shell_run commands ran with no approval prompt (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel). Lasso Security reports that the injected command was persisted to the agent's cross-session memory, with automatic re-execution seen once and not reproduced, so unconfirmed. The CISA (Cybersecurity and Infrastructure Security Agency) enrichment of the CVE record marks exploitation as 'poc', a proof of concept. As of 21 October 2026.",
   "reason": "Follows the editor's call H1 of 21 October 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[OpenSRE].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-20",
 "last_reviewed": "2026-10-22",
 "reviewed_by": null,
 "derived_by": "agent"
}