Omnigent Agent Bundle Arbitrary Code Execution via Unsanitized Tool Callable Path

Technical Analysis

The entry point is the multipart POST /v1/sessions endpoint, which accepts an agent bundle from an authenticated user. The validation routine validate_agent_bundle in bundles.py does not restrict the tools[].callable field to an allowlist of safe, intended module paths. During execution, tool_dispatch.py's _resolve_spec_callable dynamically imports the attacker-specified module and _execute_spec_callable_tool invokes the resolved function directly, meaning any importable callable in the Python environment (including subprocess.check_output) can be selected and executed. This crosses the trust boundary between 'authenticated but untrusted user input' and 'runner process execution context,' effectively turning tool specification into arbitrary code execution rather than constrained tool invocation. The attacker gains code execution with the same permissions as the runner, enabling file exfiltration, credential theft, lateral movement to internal services, and denial of availability, all without requiring administrator privileges.

Affected Systems

Omnigent

Detection Signatures

• Agent bundle tool specs referencing dotted paths outside an approved tool module namespace (e.g., subprocess.*, os.*, sys.*, builtins.*)
• Unexpected imports of subprocess, os, or socket modules triggered by tool_dispatch resolution logs
• POST /v1/sessions requests containing multipart bundles with tools[].callable fields pointing to standard library or non-tool packages
• Runner process spawning unexpected child processes shortly after session creation
• Logs showing _resolve_spec_callable importing modules never referenced in the framework's registered tool catalog

Remediation Steps

1. 1

   Upgrade Omnigent

   Update to Omnigent version 0.3.0 or later, which fixes validate_agent_bundle to properly restrict callable paths.

2. 2

   Enforce callable allowlisting

   Restrict tools[].callable values to a strict allowlist of vetted, namespaced tool modules; reject any path resolving to standard library or non-tool packages.

3. 3

   Sandbox the runner process

   Run the tool execution runner in a least-privilege, isolated environment (container, gVisor, seccomp) so that even a resolved malicious callable cannot access host credentials or the broader network.

4. 4

   Audit and monitor bundle submissions

   Log and alert on all agent bundle uploads and tool_dispatch resolutions, especially any callable outside expected module prefixes.

5. 5

   Require re-authentication/approval for bundle execution

   Add an administrator review or signing step for agent bundles before they are executed by the runner, especially in multi-tenant deployments.