The legitimate user asked only for weather information. The attacker-controlled MCP tool returned text instructing the model to invoke a bash tool, and the tested Qwen model complied, creating a harmless proof file. The framework enabled the shell tool by default without an independent execution policy. The observed model-dependent success is a controlled…
Inspect the ClaimsCase · DiggingBeagle record
Mini-Agent weather tool output induced shell execution in a local model test
A security reporter demonstrates that Mini-Agent 0.1.0 with Qwen2.5-3B-Instruct executed a shell command embedded in a malicious MCP weather response; the same attempted injection was refused in a DeepSeek test.
Scope
Reported local reproduction on one agent and two model choices; no confirmed live attack and no verified fixed release.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
A reporter induced a harmless shell action from a manipulated weather MCP result in one model setup and observed refusal in a different model. Tool availability, model behavior and host permissions all condition the result. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-MINIMAX-MCP-WEATHER-SHELL-1 · MiniMax Mini-Agent issue 133, weather MCP tool result to shell command
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsReported local reproduction on one agent and two model choices; no confirmed live attack and no verified fixed release.
Limits and uncertaintyFull account
The legitimate user asked only for weather information. The attacker-controlled MCP tool returned text instructing the model to invoke a bash tool, and the tested Qwen model complied, creating a harmless proof file. The framework enabled the shell tool by default without an independent execution policy. The observed model-dependent success is a controlled prompt-injection example, not evidence of universal bypass or deployed malware.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-MINIMAX-MCP-WEATHER-SHELL-1A security reporter demonstrates that Mini-Agent 0.1.0 with Qwen2.5-3B-Instruct executed a shell command embedded in a malicious MCP weather response; the same attempted injection was refused in a DeepSeek test.supported
Basis: reported finding
- supportsMiniMax Mini-Agent issue 133, weather MCP tool result to shell commandprimary disclosure
MiniMax GitHub issue 133, Summary, local test results, tested model and affected command execution code
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Require host-side approval or allowlisted commands for shell execution, and label MCP result text as untrusted regardless of what a model decides.
Unknowns and contradictions
- Reported local reproduction on one agent and two model choices; no confirmed live attack and no verified fixed release.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211