Analysis · DiggingBeagle record
Four checks between an authenticated agent and an authorized effect
Letta, Coze, JoySafeter, IntentKit and OpenSRE show different ways to grant a caller more authority than the interface suggests. The failures concern separate gates, so a single login or safety prompt cannot repair them.
- Published
- Oct 23, 2026
Overview
A client can log in to an agent service, receive a valid response, and still act outside its delegated authority. The failure may occur before authentication, at resource selection, when a tool starts a process, or when an irreversible action should have required approval. Several October disclosures demonstrate why those gates must be tested independently rather than grouped under a single claim that an agent is "secured".
Four gates, four different tests
| Gate | Observed failure | What a successful test must establish |
|---|---|---|
| Admission | Letta default deployment left execution and administration routes reachable without the secure-server middleware. | Every reachable API path rejects an unauthenticated caller. |
| Object authority | With Letta's shared password enabled, a client-selected user_id could still select another tenant; Coze workflow handlers checked membership in one supplied space without binding the workflow ID to that space. |
The authenticated principal is authorized for the specific object and operation. |
| Process authority | Letta's local runner copied server credentials into tool subprocesses; JoySafeter's selectable backend could execute a host shell despite a virtual filesystem setting. | Tool code runs with only the process, filesystem, network and credential authority assigned to that task. |
| Effect approval | OpenSRE's shell tools were configured without approval, while its headless presenter permitted the calls. | An enforcing component checks the actual action just before execution, including unattended paths. |
These are different vulnerabilities, not successive phases of one exploit. Letta's tenant-header report matters precisely because enabling a password did not bind a request to its asserted tenant. Coze's debug runner is conditional on a development configuration, whereas its workflow-ownership gap is documented independently. Describing both as universal Coze production shell access would erase this deployment distinction.
What the evidence allows
The Letta, Coze, JoySafeter, IntentKit and OpenSRE reports are controlled reproductions or published advisories. None of the scoped records establishes an aggregate production-victim count. They support targeted authorization and isolation tests, but not a universal prevalence rate. A useful assurance review therefore follows the real execution chain: who authenticated, whose object was selected, which backend ran, and which component permitted the resulting effect. Passing one stage provides no evidence that the other three enforce their own boundaries.