AgenticMail Cross-Agent Task Authorization Bypass
First seen Jul 21, 2026 · Updated Jul 21, 2026
AgenticMail's task API let any authenticated low-privileged agent enumerate and hijack tasks belonging to other agents by guessing/looking up their names and task IDs. This breaks the intended per-agent task isolation, allowing one agent to claim, complete, or fail work assigned to another. The vendor fixed this in version 0.9.64.
Technical Analysis
The `GET /api/agenticmail/tasks/pending?assignee=<name>` endpoint returned full task objects (including task IDs and payloads) for any agent name supplied, without verifying that the requesting agent had authority over that assignee. Because agent names are discoverable via the public `accounts/directory` endpoint, the task ID — intended to function as an unguessable capability token — became effectively a public identifier once paired with the assignee name. Attackers could then feed the leaked task IDs into `/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, or `/tasks/:id/fail` to mutate another agent's task state, resulting in a full cross-agent authorization bypass. This is a classic IDOR/broken object-level authorization flaw applied to an agent-to-agent task delegation system, undermining trust boundaries between cooperating AI agents sharing the same platform.
Affected Systems
@agenticmail/api
Detection Signatures
- Unexpected GET requests to /api/agenticmail/tasks/pending with assignee parameters not matching the requesting agent's own identity
- Repeated calls to /api/agenticmail/accounts/directory followed by cross-agent task queries
- Claim/complete/fail calls on task IDs not previously issued to the calling agent
- Anomalous task state transitions (claimed/completed/failed) initiated by an agent identity different from the original assignee
Remediation Steps
- 1
Upgrade AgenticMail API
Update @agenticmail/api to version 0.9.64 or later, which fixes the authorization check.
- 2
Enforce object-level authorization
Ensure all task query and mutation endpoints verify that the requesting agent identity matches (or is explicitly authorized for) the task's assignee, independent of task ID or assignee name knowledge.
- 3
Treat task IDs as non-secret
Do not rely on task IDs alone as capability tokens; combine with server-side ownership checks or issue signed, agent-bound capability tokens.
- 4
Restrict directory enumeration
Limit or rate-limit access to the agent directory endpoint to reduce reconnaissance of valid agent names.
- 5
Audit task mutation logs
Review historical logs for claim/complete/fail actions performed by agents on tasks not originally assigned to them.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.