CVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted tools

Summary

IntentKit through 2.6.3 has an authorization bypass in which the executor checks tool calls against the full tool registry instead of the per-request narrowed tool set enforced by ToolBindingMiddleware. This lets owner-only, state-changing tools such as wallet transfer, posting, memory-write and call-agent run without a human-in-the-loop or approval gate. An unauthenticated or public caller in the WEB, API, TWITTER or TELEGRAM contexts can exploit it by supplying the de-advertised tool name and arguments through indirect prompt injection, or by replaying checkpoint and history data on a reused thread.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Prompt injection and jailbreaks

Related items

• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPolicy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy RewardsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• InfoTRACER: Trace-Regularized Training Against Indirect Prompt InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)