Tool visibility is not an authorization check. VulnCheck's CVE-2026-76066 analysis describes an IntentKit workflow in which middleware filters the tool list presented to an ordinary user, while the final ToolNode execution path dispatches against a broader collection without rechecking the caller's policy. The resulting boundary can be crossed if an agent…
Inspect the ClaimsCase · DiggingBeagle record
IntentKit hid restricted tools without enforcing their execution permissions
A published analysis reports that caller-specific tools were filtered from prompts but ToolNode could still invoke tools registered under a more privileged principal.
Scope
IntentKit affected releases and execution paths where registered tools exceed the current caller's allowed tools.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
VulnCheck and CVE-2026-76066 document an executor authorization bypass for hidden owner-only tools in releases through 2.6.3. The published mechanism is specific to tool selection and authorization and not evidence of observed production wallet theft or a verified patched release.
Assessed Oct 17, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-INTENTKIT-VISIBLE-NOT-EXEC · VulnCheck: IntentKit tool execution authorization bypass
At a glance
Model instruction context must not be treated as the final access-control list for effectful tool invocation.
Read the implicationsNo verified production attacker campaign or wallet withdrawal confirmed. The advisory names a corrective commit, but its implementation and first containing release were not independently verified.
Limits and uncertaintyFull account
Tool visibility is not an authorization check. VulnCheck's CVE-2026-76066 analysis describes an IntentKit workflow in which middleware filters the tool list presented to an ordinary user, while the final ToolNode execution path dispatches against a broader collection without rechecking the caller's policy. The resulting boundary can be crossed if an agent is led to call a restricted tool by name despite that tool being absent from the current user's displayed catalog.
The mechanism matters for wallet, persistent-memory and social-media tools because their consequences depend on the authority of the executed operation, not on which tool descriptions the model was shown. The finding identifies an execution-authorization gap, not observed real wallet theft. An exploit still depends on a reachable affected deployment, the caller's task context and the model invoking the hidden name.
No publication should claim every IntentKit user or every installed tool has been exploited. The concrete lesson from the described code path is that each tool invocation must independently enforce principal, operation, parameters and authorization, including after conversation reuse.
The later remediation guidance names commit 5b91da57 and recommends execution-time enforcement of the context-filtered tool set. This research verified that published recommendation, not the patch implementation or a released version.
Mechanism, preconditions and effects. IntentKit filtered a user-visible list of tools for the model but retained registered private tools in the execution graph. A caller who caused ToolNode to dispatch a restricted tool name could therefore cross from prompt-level hiding to an actual privileged operation. The controlled advisory demonstrates a harmless unauthorized tool call; it does not show a real cryptocurrency transfer or loss.
Comparison and evidence limits. The permission boundary belongs at tool execution, not the prompt. This matches the separate failure in Coze workflow ownership, where checking one resource identity does not authorize another, but the prerequisites and target effects differ. The corrective commit named by an advisory is not yet verified as present in a particular public release.
Timeline
- Oct 15, 2026disclosure
Public disclosure
Claims & evidence
CLM-INTENTKIT-VISIBLE-NOT-EXECVulnCheck reports that IntentKit visible-tool filtering was not repeated as an authorization check when ToolNode executed a named tool.supported
Basis: reported finding
- supportsVulnCheck: IntentKit tool execution authorization bypassprimary disclosure
Technical description; ToolBindingMiddleware and ToolNode
CLM-INTENTKIT-REMEDIATION-COMMITThe Lasso advisory recommends an IntentKit release containing commit 5b91da57, or building from that commit while awaiting a release; it does not name a fixed release. supported
Basis: reported finding
- supportsIntentKit CVE-2026-76066 remediation guidanceprimary disclosure
Suggested Remediation, item 1
Implications
Model instruction context must not be treated as the final access-control list for effectful tool invocation.
Controls and mitigations
- Bind execution permission to the current caller, request and thread at ToolNode dispatch, rather than treating hidden tool advertisements as the access control.
- Revalidate authorization for privileged wallet, social-publishing, memory-write and delegated-agent calls after history or checkpoint replay.
- Authorize each tool invocation against the current principal and specific tool before execution. Confirm the known corrective commit and its shipped version independently before asserting an installation is patched.
Unknowns and contradictions
- No verified production attacker campaign or wallet withdrawal confirmed.
- The advisory names a corrective commit, but its implementation and first containing release were not independently verified.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183