Lasso Security: five agent platforms ship an ungated shell tool

01What happened

Lasso Security published six CVEs between October 12 and 15, 2026 against five self-hosted AI agent platforms: OpenSRE, MoviePilot, LangAlpha, piflow and Cognition. Noy Pearl, Michael Sromin and Ophir Dror are the credited researchers. Lasso rates four of the six Critical, and reproduced the flaws in local harnesses rather than against live services.

02How it works

The shared pattern is a command-execution tool that stays in the agent's tool set and never asks a human. In piflow and Cognition a single unauthenticated HTTP request makes the agent run a shell command. In OpenSRE, MoviePilot and LangAlpha the trigger is indirect prompt injection: text the agent already reads, such as a Grafana alert annotation, a web page or torrent metadata, carries instructions that make the model call the tool. The child process inherits the full environment, so a command reaches whatever credentials the agent holds.

03Who is affected

Operators who self-host these projects are exposed, not agent users in general. piflow's chat endpoints need no authentication and bind to all interfaces by default, Cognition's REST API authenticates no caller before v0.13.0, and MoviePilot's affected 3.1.5 is its current release. OpenSRE matters most where the agent's credentials are production infrastructure credentials, which Lasso says is the normal case for an SRE agent.

04What to do

Put these servers behind authentication or take them off the network, because no advisory except Cognition's names a patched version. Upgrade Cognition to v0.13.0 and remove COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION from deployments copied out of its Docker Compose quick start. Where a platform allows it, require approval on the shell tool and pass child processes a scoped environment instead of the whole one.

Questions people ask

Am I affected if I self-host OpenSRE?

OpenSRE deployments are exposed wherever the agent processes alert text from Grafana, Loki or similar sources, because its shell_run tool never sets the approval flag. Lasso also found that headless surfaces, the gateway and scheduled runs auto-approve every tool call. A fail-open branch lets an unauthenticated messaging user reach the tool directly when pairing is disabled and no allowlist is configured.

Is there a patch for these agent platform CVEs?

Only Cognition has one. Lasso says versions before v0.13.0 are affected, and that v0.13.0 disables the local shell backend unless an operator turns it on. The advisories for OpenSRE, MoviePilot, LangAlpha and piflow name no patched version, and MoviePilot's affected 3.1.5 is the newest release its repository lists. Treat those four as unpatched and rely on network controls.

How does an operator tell whether an agent's shell tool asks for approval?

Reading the tool definition for an approval flag is the check, because that is where every flaw in this wave sits. Lasso points at requires_approval in OpenSRE, interrupt_on in piflow and Cognition, and a human-in-the-loop middleware in LangAlpha that was wired up but never covered its Bash and ExecuteCode tools. MoviePilot is worse: the model sets the denylist bypass itself.

How does this wave relate to the IntentKit authorization bypass?

Lasso's vulnerability database lists CVE-2026-76066 against IntentKit, an authorization bypass published on October 13, 2026 and rated High, from the same three researchers. That disclosure is separate and sits outside the six CVEs described here. The flaws in this item share one root cause instead: a command-execution tool the agent can call without a human approval step.

Sources 7 links, all fetched

1. 1lasso.securityOpenSRE Advisory
2. 2lasso.securityMoviePilot Advisory
3. 3lasso.securitypiflow Advisory
4. 4lasso.securityLangAlpha RCE
5. 5lasso.securityLangAlpha Cross-Tenant
6. 6lasso.securityCognition Advisory
7. 7vulncheck.comVulnCheck MoviePilot