A shell behind a login
During a live engagement, the firm CyberStrike found a multi-tenant AI product whose CopilotKit agent, version 1.68.1, was wired to a tool called execute that ran server-side shell commands. The tool had no allow-list. Any authenticated tenant member could send a request to the agent and read the output.
The team confirmed it with a simple probe. A request running id, hostname, pwd and uname returned real output from an Amazon Linux 2023 host: a low-privilege service account. An echo summing two six-digit numbers came back with the right answer, exit code zero.
What it signals
The model refused some commands, such as reading /etc/passwd, which made the boundary look enforced. CyberStrike says that refusal is the trap. "It is model policy, not authorization," the firm wrote, and nothing in the system stops the tool from running those commands. An uploaded document carrying an indirect prompt injection was enough to drive the same read_file and execute calls on its own.
The target and vendor are withheld under an NDA, so the finding cannot be independently checked. The log cannot verify it. CyberStrike rates the flaw HIGH severity, CWE-78, with the request body as the vector. The shell was a sandboxed, low-privilege service account, and how far an attacker gets from there depends on that sandbox's hygiene: its egress, its secrets, its IAM role.
Log take: The refusal looked like a control but was only the model's policy, and the only boundary sat inside the model, the one thing an attacker gets to talk to. (Interpretation; single-source, anonymised pentest.)