1. Gateway Configuration Mutation (GHSA‑7jm2‑g593‑4qrc)
- Issue: Security guards failed to protect sensitive operator‑trusted settings such as sandbox policies, plugin enablements, SSRF policies, and filesystem hardening rules.
- Risk: Prompt‑injected instructions could persistently alter these critical settings if the AI model had gateway tool access.
- Fix: Patch blocks model‑driven mutations across a broader set of trusted paths.
2. Tool Policy Enforcement Bypass (GHSA‑qrp5‑gfw2‑gxv4)
- Issue: Bundled Model Context Protocol (MCP) and Language Server Protocol tools could be added after core filtering rules were applied.
- Risk: Strict tool policies (deny lists, sandbox rules, owner‑only restrictions) could be bypassed, leaving unauthorized tools active.
- Fix: Latest release enforces a final comprehensive policy check before merging bundled tools.
3. Host Override & Credential Exposure (GHSA‑h2vw‑ph2c‑jvwf)
- Issue: Workspace environment files could override API host settings.
- Risk: Attackers could redirect credentialed requests to malicious servers, exposing API keys in authorization headers.
- Fix: API host setting injection via workspace files is now blocked.
Why This Matters
- AI agent frameworks are increasingly targeted because they bridge models with sensitive system tools and APIs.
- Prompt injection and local environment manipulation are emerging attack vectors that bypass traditional perimeter defenses.
- Credential exposure is particularly dangerous, as it can lead to lateral movement across systems and cloud environments.