AgentScope treated the file-writing tee command as safe without human approval

The AgentScope Bash-tool safety classifier treated tee as a safe command even though it writes files and short-circuited before destination-path danger checks.

CVE-2026-123023 documents policy bypass for write effects without required human approval, with 2.0.9 identified as fixed. The effects remain limited by the tool process filesystem permissions.

The decisive mistake is a control-flow shortcut inside the Bash-tool permission classifier. Once tee is recognized as safe by executable name, the classifier can skip the checks that would normally examine write effects and protected paths. A safe-looking input pipeline can therefore write to files accessible to the agent process. The advisory names version 2.0.9 as the corrective release; it does not prove that other write-capable shell forms are comprehensively blocked. The tested problem is approval bypass within the tool's own filesystem authority, not privilege escalation beyond the operating-system account.

This finding starts after a tool call has already been admitted. The caller may be a legitimate agent, yet classifying a shell verb as harmless authorizes a write that the user never approved. Fixing the shared user-identity weakness or the MCP server-registration path does not repair this per-action review. The version 2.0.9 fix addresses the reported tee behavior, while the advisory does not establish whether every shell alias or pipeline with a write effect is classified correctly.