The report
The user wanted weather information. Instead, an attacker-controlled MCP weather response carried an instruction to run a shell command. A reporter's October 31 Mini-Agent issue says a locally hosted Qwen2.5-3B-Instruct model complied and created a harmless test file. Under the same test, deepseek-flash refused.
The reported configuration exposed a bash tool without an independent host authorization policy. Consequently, whether the command ran depended on how the model interpreted untrusted tool text. The issue does not establish an actual victim, persistent malware, or a measured failure rate across all Mini-Agent deployments.
The tool result was data, not permission
A weather service is allowed to provide forecast data, not operating-system instructions. Here the returned text crossed from an information channel into the agent's privileged action-selection channel. This is the same class of boundary that a prompt-injection filter tries to defend, but the reliable enforcement point is at the effect: a command executor can require policy or explicit confirmation even when the model requests execution.
The Case links the controlled evidence and the model-dependent outcome. A safer evaluation should compare legitimate weather-task completion as well as whether forbidden shell effects occurred.