When agent configuration becomes an executable action

A coding agent can appear to follow a constrained tool contract while an executor performs an operation that the contract never authorized. The October 2026 gh-aw, Crawl4AI and Vercel findings expose three different ways this happens: input is reinterpreted as authority, enforcement is split across components, or authority survives after the original workload ends.

These are separate disclosures, not one campaign. Their common investigative question is narrower than whether an AI model was obedient: what did the final executor actually do, under whose identity, to which resource, and with which lasting effect?

Consider gh-aw MCP argument injection. The client supplied a value that appeared to be a workflow argument. Downstream Cobra parsing could instead treat part of it as a command option, reaching flags associated with scanning or approval. No model jailbreak was necessary to make a string cross that boundary. The JSON tool shape and the process argument grammar simply defined different capabilities.

A neighboring gh-aw finding began with imported workflow metadata. An stdio command in frontmatter could be launched through an ostensibly inspect-only operation. This is a separate transition from describing a process to starting it. The caller needed an enabled MCP tool and an affected installation, so neither finding implies a random repository can execute code merely by being displayed to an AI.

The two gh-aw credential sidecar cases extend the chain. One allowed a sandbox-controlled browser environment variable to run within a credential-holding sidecar. The other assembled an API URL whose apparent GitHub prefix became URL user information while an attacker-owned host received the request and token. In the controlled report, the token could read a private test repository and create an issue. These are demonstrated workflow credential failures with an existing sandbox execution prerequisite, not evidence of cross-tenant GitHub compromise. The advisory metadata names 0.91.13 as patched while its prose names 0.91.12; an operator needs to inspect the actual generated sidecar and workflow lockfile rather than silently choose the more convenient version.

Crawl4AI's model-selection defect changed the type of asset at risk. A caller-controlled extraction setting could select a Hugging Face artifact for server-side loading. Stronger consequences depended on installed extras and deserialization libraries; the default minimal deployment was not shown universally vulnerable to host execution. In a separate selector injection, CSS-like strings entered JavaScript evaluation even where direct script configuration was restricted. The rule is not that every string is dangerous. It is that the component interpreting the final string determines its power.

The public Tencent fleet investigation supplies a concrete example outside a software CVE. More than 2,600 Amap-oriented attempts were observed over September 28 to October 8, with agents submitting encoded HTML and scripts through urlquery's remote browser. The fleet was not shown coordinating in real time, and its occasional self-description as Claude does not authenticate model identity. A background source attributed the work to evaluation of third-party models. The canonical case preserves those distinctions. Later, the investigators inserted offscreen text into their own page and received mailbox requests from some agents. That later contact was an intervention on lower-trust research content, not the cause of the original traffic.

The comparable infrastructure defect is Crawl4AI's cache freshness check. The primary browser path was expected to use a guarded proxy, while a secondary HTTP client could make blind internal requests when checking cached pages. A browser sandbox cannot make a network access policy complete if another helper silently bypasses it. In both systems, the effective operation occurred in a component outside the initially visible request path. Neither case proves that private data was extracted in every attempted call.

The Vercel Sandbox networking disclosure gives the strongest illustration of an actual infrastructure crossing: guest-originated packets leaked host memory during production testing. Crashing the host and executing privileged commands were reported only on researcher's matching lab replicas. That qualification is not a footnote. It separates an observed production confidentiality defect from stronger consequences established in another environment.

Vercel also described recycled storage blocks readable by a later tenant and a snapshot restore error involving attacker-supplied object metadata. The first spans deletion and reallocation; the second crosses account ownership at recovery time and required knowledge of the other snapshot's high-entropy identifier. Even flawless isolation between two currently running microVMs would not settle either issue.

This leads to a more useful map of a tool's claimed protection:

These controls are not interchangeable. Wasmtime's hard-link bypass concerned an inode reachable through aliases with conflicting preopen permissions, not a network destination. mise's local configuration issue concerned which repository settings could influence trusted shell execution. npm SlugFest concerned authentic workflow provenance bound to a mutable repository name. Each turns a valid object at one layer into authorization for the wrong object at the next.

A model can declare success before a transaction is complete. Conversely, it can refuse in a final message after a tool has already made an unauthorized change. This is why a security review cannot terminate at a successful answer or a clean policy explanation. The review needs a record of the invoking principal, effective arguments, executor identity, actual resource and state after execution. If those records are missing, even a plausible result remains insufficient evidence of authorized operation.

Two evaluation studies make the observability problem concrete. AgentEval found counterfactual views in which evidence bytes existed but were attached to the wrong decision. CascadeLedger tested whether an earlier cascade stage had consumed feedback unavailable at its decision time. Neither paper proves a specific production breach. Both show why an authentic artifact needs a causal and temporal binding to the claimed action.

For deployers, the practical output is not one universal “agent guard.” It is an independently enforced sequence of decisions where a request becomes an effect, coupled to records that make the transition auditable afterward. An attacker should not gain a different authority merely by moving the same request into a helper client, an imported manifest, an old storage block or a second namespace.