Trinity agent credentials could reach Telegram binding controls reserved for owners

Trinity issues agent-scoped credentials for model-connected work. The advisory describes Telegram management routes which treated an agent credential as sufficient to reach owner-only actions. A compromised or attacker-directed agent could call those endpoints to test a bot, replace its binding or remove it, rather than remaining confined to its expected operational scope. The failure lies at an API authorization boundary and does not require a malicious model to forge a human session.

The GitHub advisory database labels versions through 0.9.5 affected but lists no fixed version. The alleged exploitation route is plausible from the reported code references, but the present investigation did not reproduce a deployed instance or prove Telegram-message delivery in the wild.

A normal agent credential is a valid identity for calling some MCP-backed operations, but it must not inherit a human owner's authority to bind or change Telegram bot configuration. The reported router permitted calls that can test messaging or modify bindings with credentials already stored by the platform. This is a principal-to-action authorization mismatch: stealing the owner's browser session is not part of the stated precondition. Verification should compare owner, regular agent and ephemeral agent keys across every affected route, since token type and route policy are separate inputs.