On 8 October, GitHub published a CVSS 10.0 advisory for PraisonAI, an open-source multi-agent framework: its CodeAgent executed LLM-generated Python with every environment variable of the parent process, even when developers had set sandbox=True. If your agents can write code or call shell tools, a prompt injection is no longer a content problem; it is remote code execution.
AG Tech Consulting's advice for clients this week: inventory every agent framework in your stack that can execute code, write files or run commands, verify in the source (not the docs or config) how isolation is enforced, and strip secrets from any process that runs model output.
What was disclosed
CVE-2026-61447: CodeAgent, CVSS 10.0
The advisory (GHSA-2xv2-w8cq-5gxw, reviewed and published 8 October) says CodeAgent._execute_python() runs LLM-generated code in a subprocess built with os.environ.copy(). That hands OPENAI_API_KEY, DATABASE_URL and cloud credentials to whatever the model writes.
There is no AST validation and no import restriction. Most important, the CodeConfig field sandbox, which defaults to True, is never read by the execution path. The advisory calls it dead code. By contrast, the project's separate execute_code tool already used an empty environment. The fix landed in version 1.6.78. Weaknesses listed: CWE-200 and CWE-94.
GHSA-9mp3-24cc-77mg: AICoder, CVSS 9.9
A second advisory the same day covers the AICoder UI component. It exposes write_to_file and execute_command to the LLM. Paths are joined with os.path.join, which accepts absolute paths, so os.path.join("/app", "/etc/passwd") resolves to /etc/passwd. Commands go to asyncio.create_subprocess_exec with no allow-list.
The published proof of concept writes a cron entry into /etc/cron.d. Because the project's Docker images had no USER directive, the containers ran as root.
CVE-2026-107286: Pydantic AI, CVSS 7.5
Also published 8 October: in Pydantic AI 2.10.0 up to 2.53.0, streamed requests through ConcurrencyLimitedModel or limit_model_concurrency could keep shared slots forever. The anyio.CapacityLimiter ties a slot to the task that borrowed it, but stream cleanup can run in a different task. A client that keeps starting streams and disconnecting can use up capacity and deny service. Fixed in 2.53.0.
Why this is a pattern, not a one-off
All three bugs live in the plumbing between the model and the host, not in the model. The model is doing what it was told. The framework trusts its output as if it were the developer's own code.
The same week, Adversa AI published Cryptographic Context Injection against GitHub Copilot CLI: instructions hidden as ciphertext on a web page, which the agent decrypts in its own shell and then trusts. GitHub validated the finding but declined to treat it as a vulnerability. Injection payloads are getting harder to filter, so the execution layer has to hold.
Future risks to plan for
1. Config flags that lie. A boolean named sandbox gives auditors and buyers false comfort. Expect more advisories where security settings exist in the schema but not in the code path.
2. Secrets by inheritance. Agents usually run inside the same process as your API keys. Any code execution path that copies the environment turns one injected prompt into a credential breach across your cloud estate.
3. Indirect injection at scale. The CodeAgent advisory names tool results and ingested content as vectors. As agents read more email, tickets and web pages, the attacker no longer needs access to the chat box.
4. Root by default. Quick-start containers that run as root turn an application bug into a host takeover. Many internal agent pilots ship straight from these images.
5. Availability attacks on shared model capacity. The Pydantic AI bug shows how rate limiters and concurrency pools become a denial-of-service target when one tenant can lock up capacity for all.
A 9-point checklist for CTOs
List every agent framework and version in production and in pilots; patch PraisonAI to 1.6.78 or later and Pydantic AI to 2.53.0 or later. Search your own code and dependencies for os.environ.copy() or inherited environments near any subprocess that runs model output. Run model-generated code only in an isolated sandbox (gVisor, Firecracker microVM or a locked-down container) with an empty environment and no default network egress. Check that every "sandbox" or "safe mode" setting is actually enforced, by reading the code path or testing it. Put a deterministic policy gate outside the model in front of every file write, shell command and network call. Resolve and allow-list file paths; reject absolute paths and traversal before any write. Run agent containers as non-root, with read-only root filesystems and dropped capabilities. Give agents short-lived, narrowly scoped credentials from a broker instead of long-lived keys in environment variables. Log every tool call with its triggering input, and red-team agents with indirect injection through documents and tool results.
The bottom line
Agent frameworks are moving faster than their security reviews. The October advisories are a useful wake-up call: treat model output as untrusted input, and treat every tool an agent can call as a privileged API that needs its own guardrails.
Sources: GitHub Advisory GHSA-2xv2-w8cq-5gxw / CVE-2026-61447 (OSV); GHSA-9mp3-24cc-77mg (VulnWatch); CVE-2026-107286 (Pydantic AI); Adversa AI, "Cryptographic Context Injection steals developer secrets" (6 Oct 2026).
Want to pressure-test your agent stack? Write to avinash@agtechconsulting.ai. Learn more at agtechconsulting.ai.
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
