Summary
IntentKit through 2.6.3 can authorize tool calls against its complete tool registry instead of the smaller set advertised for a particular request. A public or unauthenticated caller may therefore invoke owner-restricted, state-changing capabilities without human approval when the application is exposed through supported WEB, API, TWITTER, or TELEGRAM contexts.
IntentKit through 2.6.3 can authorize tool calls against its complete tool registry instead of the smaller set advertised for a particular request. A public or unauthenticated caller may therefore invoke owner-restricted, state-changing capabilities without human approval when the application is exposed through supported WEB, API, TWITTER, or TELEGRAM contexts.
Affected context
The issue occurs in IntentKit deployments where ToolBindingMiddleware narrows the tools available to a request, but the executor performs authorization against the global tool registry. Risk is higher when public-facing channels accept indirect prompt content or reuse threads, checkpoints, or history that can influence tool selection. Affected capabilities may include wallet transfers, posting, memory writes, and agent-to-agent calls.
The issue occurs in IntentKit deployments where ToolBindingMiddleware narrows the tools available to a request, but the executor performs authorization against the global tool registry. Risk is higher when public-facing channels accept indirect prompt content or reuse threads, checkpoints, or history that can influence tool selection. Affected capabilities may include wallet transfers, posting, memory writes, and agent-to-agent calls.
Exploit preconditions
- Attack surface: IntentKit tool execution exposed through WEB, API, TWITTER, or TELEGRAM contexts
- Required access: A public or unauthenticated ability to submit content that reaches the executor
- Trigger point: A tool-call request processed after per-request tool advertisement has narrowed the visible capability set
- Why exploitation is possible: Authorization checks consult the full registry rather than the request-specific allowlist, so restricted tools may remain executable despite not being advertised
- Additional condition: Indirect prompt influence or replayed checkpoint and history data may be able to cause selection of a de-advertised tool
- Attack surface: IntentKit tool execution exposed through WEB, API, TWITTER, or TELEGRAM contexts
- Required access: A public or unauthenticated ability to submit content that reaches the executor
- Trigger point: A tool-call request processed after per-request tool advertisement has narrowed the visible capability set
- Why exploitation is possible: Authorization checks consult the full registry rather than the request-specific allowlist, so restricted tools may remain executable despite not being advertised
- Additional condition: Indirect prompt influence or replayed checkpoint and history data may be able to cause selection of a de-advertised tool
Why this happens
The underlying bug is an authorization boundary mismatch. ToolBindingMiddleware establishes a request-scoped set of permitted tools, but the executor validates requested tools against broader global registry membership instead of enforcing that narrowed set.
This behavior maps to CWE-862: Missing Authorization, because the system fails to verify authorization for the specific protected operation and context. The insecure pattern is treating capability registration or general availability as sufficient authorization for a request-specific, owner-restricted action.
The underlying bug is an authorization boundary mismatch. ToolBindingMiddleware establishes a request-scoped set of permitted tools, but the executor validates requested tools against broader global registry membership instead of enforcing that narrowed set.
This behavior maps to CWE-862: Missing Authorization, because the system fails to verify authorization for the specific protected operation and context. The insecure pattern is treating capability registration or general availability as sufficient authorization for a request-specific, owner-restricted action.
Potential impact
- Unauthorized wallet transfers or other financial operations could occur
- Owner-restricted posts or external communications could be created
- Persistent agent memory or application state could be modified
- Unauthorized calls to other agents or services could be initiated
- Data integrity, account control, or operational trust could be weakened
- Abuse of connected tools could cause further compromise depending on granted privileges
- Unauthorized wallet transfers or other financial operations could occur
- Owner-restricted posts or external communications could be created
- Persistent agent memory or application state could be modified
- Unauthorized calls to other agents or services could be initiated
- Data integrity, account control, or operational trust could be weakened
- Abuse of connected tools could cause further compromise depending on granted privileges
General mitigation guidance
Mitigation generally focuses on making authorization deny-by-default and binding every tool invocation to the request-specific capability set.
Common defensive patterns include:
- Enforcing the narrowed, per-request tool allowlist at the final execution boundary
- Treating non-advertised tools as unauthorized even when present in the global registry
- Applying explicit owner approval or human-in-the-loop gates to state-changing operations
- Separating read-only capabilities from financial, posting, memory-write, and agent-call privileges
- Revalidating authorization after prompt processing, checkpoint restoration, and history replay
- Using least-privilege credentials and narrowly scoped tool permissions
- Preventing public channels from inheriting owner-level capabilities by default
Mitigation generally focuses on making authorization deny-by-default and binding every tool invocation to the request-specific capability set.
Common defensive patterns include:
- Enforcing the narrowed, per-request tool allowlist at the final execution boundary
- Treating non-advertised tools as unauthorized even when present in the global registry
- Applying explicit owner approval or human-in-the-loop gates to state-changing operations
- Separating read-only capabilities from financial, posting, memory-write, and agent-call privileges
- Revalidating authorization after prompt processing, checkpoint restoration, and history replay
- Using least-privilege credentials and narrowly scoped tool permissions
- Preventing public channels from inheriting owner-level capabilities by default
How teams detect issues like this
Detection can combine static analysis, code review, runtime telemetry, and policy enforcement.
- Search for authorization checks that consult global registries instead of request-scoped allowlists.
- Review whether middleware restrictions are enforced again immediately before tool execution.
- Flag execution paths that restore history or checkpoints without re-evaluating current permissions.
- Monitor calls to sensitive tools from public or unauthenticated contexts, especially when those tools were not advertised for the request.
- Add policy tests asserting that de-advertised tools remain non-executable under prompt, history, and checkpoint variations.
- Use automated code review or security analysis tools to identify missing authorization checks and privilege-boundary mismatches.
Detection can combine static analysis, code review, runtime telemetry, and policy enforcement.
- Search for authorization checks that consult global registries instead of request-scoped allowlists.
- Review whether middleware restrictions are enforced again immediately before tool execution.
- Flag execution paths that restore history or checkpoints without re-evaluating current permissions.
- Monitor calls to sensitive tools from public or unauthenticated contexts, especially when those tools were not advertised for the request.
- Add policy tests asserting that de-advertised tools remain non-executable under prompt, history, and checkpoint variations.
- Use automated code review or security analysis tools to identify missing authorization checks and privilege-boundary mismatches.
