Evidence · DiggingBeagle record
Advisory: AgentScope Bash safety classifier treats tee as read-only and approves file writes
The AgentScope Bash-tool safety classifier treated tee as a safe command even though it writes files and short-circuited before destination-path danger checks. CVE-2026-123023 documents policy bypass for write effects without required human approval, with 2.0.9 identified as fixed. The effects remain limited by the tool process filesystem permissions. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
The AgentScope Bash-tool safety classifier treated tee as a safe command even though it writes files and short-circuited before destination-path danger checks. CVE-2026-123023 documents policy bypass for write effects without required human approval, with 2.0.9 identified as fixed. The effects remain limited by the tool process filesystem permissions. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsAgentScope treated the file-writing tee command as safe without human approval: CVE-2026-123023 documents policy bypass for write effects without required human approval, with 2.0.9 identified as fixed. The effects remain limited by the tool process filesystem permissions.
GHSA-fh34-mp6h-q3xc; SAFE_COMMANDS and tee proof
- supportsAgentScope treated the file-writing tee command as safe without human approval: The AgentScope Bash-tool safety classifier treated tee as a safe command even though it writes files and short-circuited before destination-path danger checks.
GHSA-fh34-mp6h-q3xc; SAFE_COMMANDS and tee proof