Cases / REG-0037

piflow: anyone who can reach the unauthenticated chat endpoints can tell the DeepAgents chat agent to run shell commands, which its exec_shell tool executes with no human approval or allow-list; CVE published 20 October 2026

PendingSoftware agents · Enterprise work agentsMachine acts aloneDemonstration

REG-0037Updated 2026-10-225 sources, 5 linkedDisclosure corroborated

What happened

not evidenced in source. The DeepAgents chat agent in piflow 2.0.0 through 2.0.1, with an exec_shell tool. Chat messages sent by an unauthenticated attacker to POST /chat or POST /chat/stream, instructing the agent to call exec_shell. Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown. The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins ["*"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person. The agent runs arbitrary commands on the host, exposing environment secrets such as LLM API keys and database credentials. Outcome: pending; none reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical; as of Oct 2026. not evidenced in source.

Verification: 5 of 6 checks complete

✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims

✓ Sources linked5 of 5 sources link to the record (3 to a primary record)

✓ Sources checked claim by claimevery claim checked against its source on 2026-10-22

✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-21

○ Reviewed by the editornot yet reviewed by a person

✓ Reply offeredpiflow: offered

Corrections · 25, latest 2026-10-22

Changes to what this case says, with the reason. Every earlier version is kept.

2026-10-22: Fields: recovery technical. Found in the second independent re-read of 22 october 2026: two commits of 19 october (d94d233, 5985824) add and then delete a dockerfile at the repository root, so 'change only files under scientific_agents/dataset_qa/' was false of the individual commits; the combined change leaves the agent and server code untouched (git fetch of https://github.com/cas-bigdatalab/piflow).
Show the change
Before: No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated up to 22 October 2026) change only files under scientific_agents/dataset_qa/, leaving exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication
After: No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication
2026-10-22: Fields: recovery technical. Found in an independent re-read of 22 october 2026 of the claims changed that day: branch cross_dag_172 has commits dated 19, 20 and 22 october 2026 (head 9a49ac9), so '17 october 2026' was no longer the newest commit. every file those commits change since 5558000 (17 october) is under scientific_agents/dataset_qa/; nothing under agents/ or the server changed, so the finding holds (git fetch of https://github.com/cas-bigdatalab/piflow, 22 october 2026).
Show the change
Before: No fixed version is named in the sources. As of 21 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commit on any branch (cross_dag_172, 17 October 2026) keeps exec_shell and its human-approval setting unchanged and the chat routes still without an authentication check; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication
After: No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated up to 22 October 2026) change only files under scientific_agents/dataset_qa/, leaving exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication
2026-10-22: Fields: outcome. Follows the editor's call h1 of 21 october 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged.
Show the change
Before: State: averted by disclosure. No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026
After: State: pending (no fix has shipped). No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026
2026-10-21: Status text. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case.
Show the change
Before: Provisional (CNA (CVE numbering authority) advisory read 21 October 2026; no fix released as of 21 October 2026; no exploitation reported)
After: Confirmed (corroborated by the project's own code; no fix released as of 21 October 2026; no exploitation reported)
2026-10-21: Status. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed.
Show the change
Before: provisional
After: confirmed
2026-10-21: Provenance tier. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism.
Show the change
Before: disclosure_uncorroborated
After: disclosure_corroborated
2026-10-21: Outcome: state. Editor's call h1 of 21 october 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened.
Show the change
Before: averted_by_disclosure
After: pending
2026-10-21: Inference: source ids. Found in the editor's source check of 21 october 2026: the added sentence rests on the lasso security entry and the repository.
Show the change
Before: ["NVD-109442"]
After: ["NVD-109442", "LASSO-109442", "REPO-PIFLOW"]
2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: the interpretation did not say what the record does not show (runbook rule 18): no source reports an attack, the repository has no fixed release as of 21 october 2026, and the lasso security reproduction calls exec_shell directly rather than through a chat request. not signed, so no signature was reset.
Show the change
Before: Any caller who could reach the endpoint could direct the agent, and the agent could run any command; neither the caller nor the command was checked
After: Any caller who could reach the chat endpoints could direct the agent, and the agent could run any command; neither the caller nor the command was checked. The record does not show an attack, a fixed release, or a chat message carried through the model to a command: the published reproduction calls exec_shell directly on a local copy
2026-10-21: Fields: recovery technical: source ids. Found in the editor's source check of 21 october 2026: the repository is the primary record for whether a fix exists.
Show the change
Before: ["LASSO-109442"]
After: ["LASSO-109442", "REPO-PIFLOW"]
2026-10-21: Fields: recovery technical: value. Found in the editor's source check of 21 october 2026: the piflow repository (git clone fetched 21 october 2026) has master at ad8d010 = tag v2.0.1 (31 july 2026) and no later tag; branch cross_dag_172 (commit 55580007, 17 october 2026) has agents/tools.py and agents/factory.py identical to master and routers/chat_router.py '/chat' and '/chat/stream' with no authentication dependency. the lasso security remediation list also includes a minimal environment, a command allow-list, human-approval gating and treating uploads as untrusted, which the drafted summary left out.
Show the change
Before: No fixed version is named in the sources. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox, restricting CORS and network binding, and taking exposed deployments off the network or behind authentication
After: No fixed version is named in the sources. As of 21 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commit on any branch (cross_dag_172, 17 October 2026) keeps exec_shell and its human-approval setting unchanged and the chat routes still without an authentication check; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication
2026-10-21: Fields: evidence event: source ids. Found in the editor's source check of 21 october 2026: the finders, reservation date and public date come from the cve record and the vulncheck advisory.
Show the change
Before: ["NVD-109442"]
After: ["NVD-109442", "CVE-ORG-109442", "VULNCHECK-109442"]
2026-10-21: Fields: evidence event: value. Found in the editor's source check of 21 october 2026: the cve record (cveawg.mitre.org json) gives datereserved 2026-10-12, datepublished 2026-10-20, datepublic 2026-10-15 and credits three finders, and tags the lasso security reference 'technical-description' and 'exploit'; the vulncheck advisory is dated 10/19/2026 and credits the same finders. the drafted value omitted the finders and the disclosure timeline and truncated the cvss 4.0 vector.
Show the change
Before: CVE-2026-109442 published 20 October 2026 by the VulnCheck CNA; CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), CVSS 3.1 9.8; CWE-306; references piflow source at commit ad8d010 (agents/tools.py and server.py) and a VulnCheck advisory
After: CVE-2026-109442 (Common Vulnerabilities and Exposures entry) reserved 12 October 2026 and published 20 October 2026 by VulnCheck as the CNA (CVE numbering authority); the record gives 15 October 2026 as the date the flaw was made public and credits Noy Pearl, Michael Sromin and Ophir Dror as finders. VulnCheck scored it CVSS (Common Vulnerability Scoring System) 4.0 base 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and CVSS 3.1 base 9.8; weakness CWE-306. The record references piflow source at commit ad8d010 (agents/tools.py and server.py), the Lasso Security entry (tagged technical description and exploit) and VulnCheck's advisory, dated 19 October 2026
2026-10-21: Fields: outcome: value. Found in the editor's source check of 21 october 2026: the lasso security entry's reproduction is 'invoking the verbatim exec_shell' with benign canaries and 'a static ast scan' of the routes, not a chat request carried end to end; the cve record and nvd api carry cisa's ssvc (stakeholder-specific vulnerability categorization) enrichment of 20 october 2026: exploitation 'poc', automatable 'yes', technical impact 'total'. the case did not say what was reproduced or give cisa's rating.
Show the change
Before: State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and reports reproduction on a local clone at commit 817605d. As of Oct 2026
After: State: averted by disclosure. No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026
2026-10-21: Fields: envelope constraints: source ids. Found in the editor's source check of 21 october 2026: the default configuration and human-approval setting come from the maintainer's code.
Show the change
Before: ["NVD-109442"]
After: ["NVD-109442", "REPO-PIFLOW"]
2026-10-21: Fields: envelope constraints: value. Found in the editor's source check of 21 october 2026: the piflow repository at commit ad8d010 (tag v2.0.1), and identically at v2.0.0, hard-codes host '0.0.0.0' in server.py's uvicorn.run calls, sets corsmiddleware allow_origins=['*'], and in agents/factory.py sets interrupt_on to write_file, read_file and edit_file, all false, with exec_shell absent; the lasso security entry says the same ('listens on all network interfaces with permissive cors by default'). the case omitted the default configuration.
Show the change
Before: The chat endpoints lack authentication (CWE-306); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list
After: The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins ["*"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person
2026-10-21: Fields: decision: source ids. Found in the editor's source check of 21 october 2026: the lasso security entry is the source for what its reproduction did and did not show.
Show the change
Before: ["NVD-109442"]
After: ["NVD-109442", "LASSO-109442"]
2026-10-21: Fields: decision: confidence. Found in the editor's source check of 21 october 2026: same as above: the end-to-end path through the model is described, not demonstrated in the sources.
Show the change
Before: high
After: medium
2026-10-21: Fields: decision: assertion type. Found in the editor's source check of 21 october 2026: the model complying with a chat message is described by vulncheck (cve record) and lasso security, not shown in any primary record; downgraded from fact.
Show the change
Before: fact
After: assertion
2026-10-21: Fields: decision: value. Found in the editor's source check of 21 october 2026: the cve record says attackers 'can instruct the agent to call the exec_shell tool' (a capability, not an observed act); the lasso security entry's proof of concept is a placeholder prompt, and its reproduction is 'invoking the verbatim exec_shell' with test commands plus a static scan of the routes. the drafted value stated as fact that the agent follows the instruction.
Show the change
Before: The agent follows the instruction and calls exec_shell
After: Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown
2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the cve record and nvd api list both scores with source disclosure@vulncheck.com (vulncheck, the cve numbering authority): cvss 4.0 base 9.3 and cvss 3.1 base 9.8, both critical; nvd has added no score of its own. the case did not say who assigned the score.
Show the change
Before: none reported (CVSS 4.0 9.3)
After: none reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical
2026-10-21: Status text. Found in the editor's source check of 21 october 2026: the vulncheck advisory has now been read; the piflow repository shows no release after v2.0.1 (31 july 2026) and no change to exec_shell or chat-route authentication on any branch.
Show the change
Before: Provisional (CNA advisory not read in this run; no fix named in the sources; no exploitation reported)
After: Provisional (CNA (CVE numbering authority) advisory read 21 October 2026; no fix released as of 21 October 2026; no exploitation reported)
2026-10-21: Provenance tier text. Found in the editor's source check of 21 october 2026: the vulncheck advisory, which the drafting run could not open, was read (vulncheck.com, dated 19 october 2026); the nvd api shows the record's status changed from received to deferred on 20 october 2026 (lastmodified 2026-10-20t20:11:29); the piflow repository at commit ad8d010 was read.
Show the change
Before: CVE record assigned by VulnCheck (CNA) and recorded in NVD (status Received); the VulnCheck advisory it references could not be opened in this run; a Lasso Security database entry restates the flaw and reports no known exploit
After: CVE record assigned by VulnCheck (the CVE numbering authority) and recorded in the NVD (National Vulnerability Database), where its status is now Deferred (not scheduled for NVD's own analysis); VulnCheck's advisory and the Lasso Security entry describe the flaw, and the project's code at the referenced commit shows the mechanism; Lasso reports no known exploit
2026-10-21: Sources: lasso-109442: title. Found in the editor's source check of 21 october 2026: the drafted title was a description; the lasso security page's headline is 'cve-2026-109442: unauthenticated remote code execution in piflow chat agent via unsandboxed shell tool'.
Show the change
Before: Lasso Security vulnerability database entry CVE-2026-109442 (piflow): no known exploit; reproduced on a local clone at commit 817605d; remediation recommendations
After: Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool
2026-10-21: Sources: nvd-109442: title. Found in the editor's source check of 21 october 2026: the drafted title was a description; the record's title, set by the cve numbering authority vulncheck, is 'piflow 2.0.0 through 2.0.1 unauthenticated rce via chat agent exec_shell' (cve record and nvd api).
Show the change
Before: NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1, unauthenticated POST /chat and /chat/stream let callers make the DeepAgents chat agent run exec_shell commands without human approval or allow-list, CVSS 4.0 9.3
After: NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell

Record history · 4 entries

2026-10-22: Right of reply offered to piflow.
2026-10-21: Source added: cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag.
2026-10-21: Source added: VulnCheck advisory: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell.
2026-10-21: Source added: CVE record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell.

Controls that address what went wrong

3 controls missing or failed. The line under each is the concrete form it would have taken in this case.

Machine-enforceable scope

Mechanism: exec_shell runs arbitrary commands, with no allow-list. Why it interrupts: an enforced allow-list would refuse commands outside the agent's task, such as reading environment secrets. Source shows it absent: the record states there is no allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown.

Absent · Mandate layer

Actor identity verification

Mechanism: POST /chat and POST /chat/stream accept instructions for the agent from any caller, with no authentication. Why it interrupts: if the endpoints established the caller's identity by credential, an unauthenticated attacker's instruction would never reach the agent. Source shows it absent: the record states the endpoints lack authentication (CWE-306).

Absent · Actor layer

Destructive-action gate

Mechanism: exec_shell runs the commands the agent is told to run without human approval. Why it interrupts: a confirmation step before command execution would put a human decision between the attacker's message and the host command. Source shows it absent: the record states exec_shell runs commands without human approval.

Absent · Envelope layer

New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.

Get the weekly email

How it unfolded, layer by layer

MandateWhat it was told to do

Who deployed it: not evidenced in source. The task: not evidenced in source.

Absent: Machine-enforceable scope

ActorWhat acted

The DeepAgents chat agent in piflow 2.0.0 through 2.0.1, with an exec_shell tool

Absent: Actor identity verification

InputsWhat it could see

Chat messages sent by an unauthenticated attacker to POST /chat or POST /chat/stream, instructing the agent to call exec_shell

DecisionHow it chose

Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown

EnvelopeWhat it was allowed to do

Limits in place: The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins ["*"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person.

Absent: Destructive-action gate

ActionWhat it did

The agent runs arbitrary commands on the host, exposing environment secrets such as LLM API keys and database credentials

OutcomeWhat happened

Pending. Severity: none reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical.

EvidenceWhat can be proven

Record of the event: CVE-2026-109442 (Common Vulnerabilities and Exposures entry) reserved 12 October 2026 and published 20 October 2026 by VulnCheck as the CNA (CVE numbering authority); the record gives 15 October 2026 as the date the flaw was made public and credits Noy Pearl, Michael Sromin and Ophir Dror as finders. VulnCheck scored it CVSS (Common Vulnerability Scoring System) 4.0 base 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and CVSS 3.1 base 9.8; weakness CWE-306. The record references piflow source at commit ad8d010 (agents/tools.py and server.py), the Lasso Security entry (tagged technical description and exploit) and VulnCheck's advisory, dated 19 October 2026.

RecoveryWhat could be stopped, undone, answered for

Technical recovery: No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication. Accountability: not evidenced in source.

The same gap in other cases

Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.

Control	Same world	Other worlds
Machine-enforceable scope	PocketOS 2026, Replit and SaaStr 2025, UK AI Security Institute: agents in a…, LangAlpha: instructions planted in web…, Vibe-Trading: instructions planted in…	The DAO 2016 (agents moving money), Benavides v. Tesla 2025 (machines), IntentKit: owner-only agent tools,… (agents moving money)
Actor identity verification	Agent-run intrusion campaign 2025, Claude Code [bot] trust 2026, Pydantic AI: a web page can make a…, Model Context Protocol (MCP) TypeScript…, Archon: control API (application…	Kia dealer portal 2024 (machines)
Destructive-action gate	PocketOS 2026, Replit and SaaStr 2025, Pydantic AI: a web page can make a…, Archon: control API (application…, destructive_command_guard: a crafted…, OpenSRE: instructions planted in alerts or…, LangAlpha: instructions planted in web…, Vibe-Trading: instructions planted in…	Triton 2017 (machines), Gemini calendar invite 2025 (software acting on machines), IntentKit: owner-only agent tools,… (agents moving money)

Cost and accountability

Severitynone reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical

AffectedNot recorded

Costnone reported

Regulatory or legal consequencenone

Technical recoveryTechnical recovery: No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication.

Accountabilitynot evidenced in source

InterpretationWhy it matters beyond its domain. Any caller who could reach the chat endpoints could direct the agent, and the agent could run any command; neither the caller nor the command was checked. The record does not show an attack, a fixed release, or a chat message carried through the model to a command: the published reproduction calls exec_shell directly on a local copy. Signed by Saurabh Bhatnagar on 2026-10-21.

Right of reply

Named party	Status
piflow	Offered 2026-10-22; awaiting response	Respond for piflow