VulnWatch VulnWatch
← All articles
Weekly digest · Oct 5, 2026

VulnWatch Weekly: Agentic RCE Epidemic & The Fall of Vibe-Trading

This week's digest highlights a catastrophic cluster of Remote Code Execution (RCE) vulnerabilities in agentic frameworks, led by critical flaws in Vibe-Trading and Devika. Security teams must immediately audit LLM tool definitions and sandbox boundaries as the 'agent-as-a-service' model faces its first major exploitation wave.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Agentic Apocalypse Begins

Executive Summary The week of September 28 to October 4, 2026, will be remembered as the turning point where the theoretical risks of agentic AI collapsed into immediate, critical reality. The dominant theme is unequivocal: Agentic Remote Code Execution (RCE). We observed a unprecedented cluster of CVSS 10.0 vulnerabilities centered around LLM agents that blindly execute tool calls without adequate sanitization or sandboxing. The single most urgent item is the Vibe-Trading advisory cluster (GHSA-v2f8-6655-7grj and GHSA-jqmf-mx4f-hfr6), which exposes a full-stack RCE chain allowing unauthenticated attackers to compromise hosting environments via prompt-injected tool usage. Concurrently, the ecosystem is grappling with a wave of Model Context Protocol (MCP) server misconfigurations and sandbox escapes in Ruby and Python runtimes. While no active exploitation in the wild has been confirmed yet (is_exploited=false for all entries), the simplicity of the exploit chains suggests a narrow window for remediation before weaponization occurs.

Top Items of the Week

The following entries represent the highest impact risks identified this week. Immediate action is required for teams utilizing these components.

1. Vibe-Trading: Unauthenticated RCE & Full API Exposure

  • Identifier: GHSA-v2f8-6655-7grj / GHSA-jqmf-mx4f-hfr6
  • Severity: Critical (CVSS 10.0)
  • Affected Component: Vibe-Trading Agent (FastAPI endpoints, BashTool, BackgroundRunTool)
  • Impact: Complete system compromise. The advisory details five distinct findings including unauthenticated full-API exposure, arbitrary file write (.py/.sh), and shell injection via BashTool and BackgroundRunTool. An attacker can chain prompt injection to execute arbitrary OS commands.
  • Recommended Action: Take instances offline immediately. If offline is not possible, disable all external tool access, enforce strict API_AUTH_KEY rotation (noting the default config flaw), and apply the vendor patch released Oct 2. Audit all logs for exec_module calls.

2. Kobako Ruby Gem: Wasm Sandbox Escape

  • Identifier: CVE-2026-55107
  • Severity: Critical (CVSS 10.0)
  • Affected Component: Kobako (Ruby gem, versions < 0.9.1)
  • Impact: Arbitrary code execution in the host process. The Wasm-isolated mruby interpreter, designed to run untrusted LLM-generated code, fails to contain guest scripts, allowing them to escape the sandbox and execute arbitrary Ruby in the host.
  • Recommended Action: Upgrade to version 0.9.1 immediately. Re-evaluate the trust model for any LLM-code execution pipeline; assume Wasm boundaries are permeable until proven otherwise.

3. Devika Agent: Direct Code Injection

  • Identifier: CVE-2026-51871
  • Severity: Critical (CVSS 9.8)
  • Affected Component: Devika v1.0 (src/agents/runner/runner.py)
  • Impact: Arbitrary code execution via the Runner.execute function. The agent directly executes LLM-generated content without intermediate validation or sandboxing.
  • Recommended Action: Patch to the latest version. Implement an intermediate validation layer for all LLM-generated code blocks before execution. Do not rely on the agent's internal "safety" checks.

4. Open GenAI Stack (Meta AI Backend): Prompt Injection to RCE

  • Identifier: CVE-2026-77177
  • Severity: Critical (CVSS 9.8)
  • Affected Component: Open GenAI Stack (ogx-ai) 2026-06-11
  • Impact: Server-side expression evaluation leading to code execution. Attackers can use Jinja2 template syntax within prompts to bypass sanitization and execute code on the backend serving WhatsApp/Meta AI products.
  • Recommended Action: Apply vendor patches. Strictly sanitize all user inputs against template injection patterns (e.g., {{ }}, {% %}) before they reach the LLM context.

5. Soft Machine: Cross-Workspace Authentication Bypass

  • Identifier: CVE-2026-55176 / CVE-2026-46711
  • Severity: Critical/High (CVSS 9.0 / 8.3)
  • Affected Component: Soft Machine Cloud OS (versions ≤ 0.2.247)
  • Impact: Multi-tenant data leakage and unauthorized API access. A shared CONTAINER_SHARED_SECRET allows any tenant to authenticate to any other tenant's workspace API. Additionally, unauthenticated HTTP endpoints expose arbitrary file reads.
  • Recommended Action: Rotate all shared secrets immediately. Isolate workspace networks. Upgrade to the patched version and enforce strict tenant isolation policies.

Thematic Analysis: The State of Agentic Security

This week's 63 entries paint a grim picture for the "Agentic Web." The industry's rush to deploy autonomous agents has outpaced the development of secure tool-execution frameworks. Below we break down the specific vectors of failure.

The Agentic RCE Crisis

The most alarming trend is the prevalence of Remote Code Execution vulnerabilities stemming directly from how agents handle tools. The paradigm of "LLM decides, Agent executes" has proven fragile. In the case of Vibe-Trading, the BashTool and BackgroundRunTool acted as direct sinks for shell injection. Worse, the exec_module() finding (F8) demonstrated that even when specific bash tools are restricted, the underlying architecture allowed top-level statement execution before class checks could intervene.

Similarly, Devika (CVE-2026-51871) and zosmaai pi-llm-wiki (CVE-2026-102911) suffered from direct command injection flaws where the agent's output was passed to a shell without escaping. The lesson for platform teams is clear: Never trust the LLM's output format. Even if the model is instructed to return JSON, a determined adversary can craft a prompt that forces the model to output malicious shell syntax, which the agent then blindly executes. The solution requires strict allow-listing of commands and arguments at the runtime level, not just at the prompt level.

Model Context Protocol (MCP) & Supply Chain Risks

The Model Context Protocol (MCP) is rapidly becoming the standard for connecting AI models to data sources, but this week revealed it is also becoming a standard attack surface. We identified multiple SSRF and authorization bypasses in MCP servers:

  • Obot (CVE-2026-103758) allowed authenticated users to bypass UI deny lists and reach restricted MCP servers via the /mcp-connect-composite/ route.
  • Token Optimizer MCP (CVE-2026-55157) contained an OS command injection in the smart_user tool, allowing any client to execute shell commands via the username argument.
  • Office-PowerPoint-MCP-Server (CVE-2025-71427) suffered from path traversal, allowing attackers to write files outside the working directory by manipulating output paths.
  • LiteLLM had a particularly rough week with a slew of advisories (PYSEC-2026-4066 through 4076). Notably, an authenticated SSRF (CVE-2026-93355 context) allowed users to redirect outbound provider calls to attacker-controlled hosts, effectively exfiltrating the proxy's configured API keys.

These incidents highlight a critical supply chain risk: MCP servers are often developed by third parties with varying security maturity. Connecting an enterprise LLM to an unvetted MCP server is akin to giving that server root access to your data plane. CISOs must mandate a vetting process for all MCP connectors similar to the one used for browser extensions or mobile apps.

Sandbox Escapes and Isolation Failures

A recurring theme this week was the failure of isolation mechanisms intended to protect the host from untrusted code. Kobako (CVE-2026-55107) represents a significant failure in the Wasm sandboxing model for Ruby, where guest scripts escaped to the host. DeepSeek Harness also faced multiple issues (CVE-2026-101102, CVE-2026-101078) where the vendor explicitly noted their sandbox was "containment, not a security boundary," yet users treated it as such.

Furthermore, LevelX (CVE-2026-102730) demonstrated the dangers of AI-generated code in low-level systems. A NAND flash parser, partially generated by Copilot, contained an unbounded heap write that allowed control-flow hijacking. This serves as a stark warning: AI-generated code in security-critical paths (parsers, memory managers) requires rigorous human audit and fuzzing, as the model may hallucinate safe bounds checks that do not exist.

Prompt Injection Evolves to Template Injection

While classic prompt injection remains a threat, we are seeing it evolve into Server-Side Template Injection (SSTI). The Open GenAI Stack vulnerability (CVE-2026-77177) showed that when LLM inputs are interpolated into Jinja2 templates without sanitization, the result is not just data leakage but full RCE. Similarly, Vibe-Trading utilized Jinja2 codegen with autoescape disabled. This shifts the mitigation strategy from "prompt engineering" to strict input validation and the use of non-executable template formats.

Known Exploited Items

  • Status: As of this writing, no entries in this week's digest are marked as is_exploited=true. However, the public availability of PoCs for several vulnerabilities (e.g., zosmaai, SciPhi-AI R2R, Weaviate Verba) significantly increases the likelihood of imminent exploitation. The window for proactive patching is closing rapidly.

What to Do This Week

Given the severity of the agentic RCE cluster, security teams should prioritize the following actions immediately:

  1. Audit Tool Definitions: Review every tool exposed to your LLM agents. Ensure that no tool accepts raw shell commands or file paths without strict validation. Where possible, replace shell calls with native library functions.
  2. Enforce Sandbox Hardening: If you are using Kobako, Devika, or similar runtimes, apply patches immediately. Re-architect your execution environment to assume the sandbox is compromised; run agents in ephemeral, network-isolated containers with minimal privileges.
  3. Rotate MCP Credentials: For any MCP server in use, rotate associated API keys and secrets. Audit the network reachability of your MCP servers—ensure they are not exposed to the public internet unless absolutely necessary.
  4. Sanitize Template Inputs: Audit your codebase for any instance where user or LLM input is interpolated into a template engine (Jinja2, Handlebars, etc.). Switch to auto-escaping modes or use plain text concatenation where logic is not required.
  5. Review LiteLLM Configurations: If you operate a LiteLLM proxy, review the user_config handling and SSO flows. Apply the latest patches to prevent SSRF and credential exfiltration.

What to Watch Next Week

Next week, we anticipate a surge in "second-order" vulnerabilities as researchers dig deeper into the dependencies of the patched agents. Specifically, watch for:

  • Supply Chain Attacks on Agent Libraries: As the core agents get patched, attackers may target the underlying Python/Node libraries they depend on.
  • Data Poisoning in RAG Pipelines: With execution paths locked down, attention may shift to corrupting the knowledge bases these agents rely on.
  • Emergence of Exploit Kits: Given the simplicity of the Vibe-Trading and Devika exploits, we expect to see automated scanners and exploit kits appear on underground forums within 7-10 days.

Stay vigilant. The era of "move fast and break things" in AI security is over; the breakage is now happening to us.

Covered entries (63)