Summary
EvoScientist contains an approval bypass that can allow delegated asynchronous sub-agents to execute host shell commands without the expected interruption or approval gate. If untrusted instructions are introduced through ingested content, an attacker may influence the agent to run commands with the user's privileges and access available environment secrets.
EvoScientist contains an approval bypass that can allow delegated asynchronous sub-agents to execute host shell commands without the expected interruption or approval gate. If untrusted instructions are introduced through ingested content, an attacker may influence the agent to run commands with the user's privileges and access available environment secrets.
Affected context
The issue occurs in EvoScientist deployments that:
- Use asynchronous sub-agents or delegated task execution
- Permit those sub-agents to invoke host command execution
- Lack an effective
interrupt_onapproval or interruption gate - Process externally controlled or untrusted content as agent instructions
Risk depends on the permissions, credentials, and secrets available to the process running the agent.
The issue occurs in EvoScientist deployments that:
- Use asynchronous sub-agents or delegated task execution
- Permit those sub-agents to invoke host command execution
- Lack an effective
interrupt_onapproval or interruption gate - Process externally controlled or untrusted content as agent instructions
Risk depends on the permissions, credentials, and secrets available to the process running the agent.
Exploit preconditions
- Attack surface: Agent-driven asynchronous task execution and host shell command tooling
- Required access: Ability to cause the system to ingest or process attacker-controlled content, such as a fetched web page
- Trigger point: Delegation through
start_async_taskto a sub-agent that can execute shell commands - Why exploitation is possible: The delegated execution path can lack the authorization or interruption check intended to require approval before sensitive actions
- Attack surface: Agent-driven asynchronous task execution and host shell command tooling
- Required access: Ability to cause the system to ingest or process attacker-controlled content, such as a fetched web page
- Trigger point: Delegation through
start_async_taskto a sub-agent that can execute shell commands - Why exploitation is possible: The delegated execution path can lack the authorization or interruption check intended to require approval before sensitive actions
Why this happens
The vulnerability results from an authorization control being applied inconsistently across agent execution paths.
A parent agent or primary workflow may enforce an approval gate, while delegated asynchronous sub-agents can invoke sensitive tools without passing through the same control.
This maps to CWE-862: Missing Authorization, because a security-relevant operation is reachable without a sufficiently enforced permission decision. Treating instructions embedded in external content as trusted commands can further expose the execution path to indirect prompt injection.
The vulnerability results from an authorization control being applied inconsistently across agent execution paths.
A parent agent or primary workflow may enforce an approval gate, while delegated asynchronous sub-agents can invoke sensitive tools without passing through the same control.
This maps to CWE-862: Missing Authorization, because a security-relevant operation is reachable without a sufficiently enforced permission decision. Treating instructions embedded in external content as trusted commands can further expose the execution path to indirect prompt injection.
Potential impact
- An attacker may execute shell commands with the agent process's privileges
- The compromise could expose environment variables, tokens, or other available secrets
- The agent may modify local files, alter workflows, or tamper with collected data
- The affected host or connected services could experience unauthorized changes
- Further compromise may be possible if the runtime has broad permissions or network access
- An attacker may execute shell commands with the agent process's privileges
- The compromise could expose environment variables, tokens, or other available secrets
- The agent may modify local files, alter workflows, or tamper with collected data
- The affected host or connected services could experience unauthorized changes
- Further compromise may be possible if the runtime has broad permissions or network access
General mitigation guidance
Mitigation generally focuses on enforcing authorization consistently for every agent and tool execution path.
Common defensive patterns include:
- Applying approval and interruption gates at the tool boundary, including delegated asynchronous tasks
- Using explicit allowlists for permitted tools, commands, arguments, and destinations
- Treating fetched pages and other ingested content as untrusted data rather than executable instructions
- Running agents with least-privilege identities, isolated workspaces, restricted networks, and minimal environment secrets
- Separating planning from execution and requiring independent authorization for host command operations
- Using secure-by-default configurations that disable shell access unless it is explicitly required
These controls reduce the consequences of prompt injection and authorization inconsistencies.
Mitigation generally focuses on enforcing authorization consistently for every agent and tool execution path.
Common defensive patterns include:
- Applying approval and interruption gates at the tool boundary, including delegated asynchronous tasks
- Using explicit allowlists for permitted tools, commands, arguments, and destinations
- Treating fetched pages and other ingested content as untrusted data rather than executable instructions
- Running agents with least-privilege identities, isolated workspaces, restricted networks, and minimal environment secrets
- Separating planning from execution and requiring independent authorization for host command operations
- Using secure-by-default configurations that disable shell access unless it is explicitly required
These controls reduce the consequences of prompt injection and authorization inconsistencies.
How teams detect issues like this
Organizations can look for:
- Static analysis patterns where asynchronous task APIs invoke shell, subprocess, or equivalent execution tools without a shared authorization wrapper
- Code review signals showing approval checks in parent agents but not in delegated workers
- Policy checks that flag unrestricted command execution, broad environment access, or untrusted content being treated as instructions
- Runtime telemetry correlating ingested external content, task delegation, tool approval decisions, and command execution
- Alerts for unexpected child processes, secret access, or outbound connections initiated by agent workers
Automated code and policy review tools can help identify authorization gaps across alternate execution paths.
Organizations can look for:
- Static analysis patterns where asynchronous task APIs invoke shell, subprocess, or equivalent execution tools without a shared authorization wrapper
- Code review signals showing approval checks in parent agents but not in delegated workers
- Policy checks that flag unrestricted command execution, broad environment access, or untrusted content being treated as instructions
- Runtime telemetry correlating ingested external content, task delegation, tool approval decisions, and command execution
- Alerts for unexpected child processes, secret access, or outbound connections initiated by agent workers
Automated code and policy review tools can help identify authorization gaps across alternate execution paths.
