NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
Link copied RSS

2026-09-18 Daily Security Intelligence

2 itemsTop severity 9.8 (Critical)CSSA 2 · CVE 0 · Poisoning 0

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 9.8 Critical

agno intelligent-agent orchestration layer lacks dynamic code-execution controls by default, allowing arbitrary code execution

An attacker can exploit a model-output manipulation flaw to induce the agent to invoke an unprotected Python code-execution tool. Because the framework disables all confirmation mechanisms by default and has no policy gateway to intercept the call, malicious code runs directly in the host process through the exec function, severely damaging system integrity, confidentiality, and availability and achieving unauthenticated remote arbitrary code execution.

Component
agno is an intelligent-agent framework for AI application development. Its core components focus on orchestrating interactions between large language models and external tools, using standardized interfaces to automate the flow from model output to function calls, aiming to reduce the complexity of multimodal agent integration and improve development efficiency.
Type
Improper Control of Dynamically-Managed Code Resources (CWE-913)
Repo
github.com/agno-agi/agno · Stars 42232
Remediation
  • Developers should enable secondary confirmation for sensitive tools by default, implement policy-based pre-execution checks, and upgrade log warnings to blocking security checks, ensuring dynamically managed code resources run in a restricted sandbox or under strict privileges and eliminating default trust of model instructions.
CSSA Exclusive Early Warning 9.8 Critical

agno AgentOS defaults to no authentication on A2A, allowing unauthorized interface calls and creating a remote-code-execution risk

An attacker can exploit AgentOS default behavior when the A2A interface is enabled without configured credentials, accessing `/a2a/agents` endpoints over the network, enumerating registered agents without authentication, and sending malicious requests that trigger agent execution logic. If the target agent integrates a code-execution tool, this can lead directly to remote code execution; high-frequency calls can also cause denial of service, severely damaging system confidentiality, integrity, and availability.

Component
agno is a Python framework for multi-agent collaboration. Its core component AgentOS handles runtime management and cross-agent interoperability. The system architecture relies on a RESTful API and the JSON-RPC protocol for agent discovery, task scheduling, and message-flow processing, aiming to optimize automated collaboration among distributed AI agents.
Type
Missing Authentication for Critical Function (CWE-306)
Repo
github.com/agno-agi/agno
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →