Security brief: headless agents ship a shell and no approval gate, a critical Storybook MCP flaw, a third Agent Mesh advisory and OpenCode's provider response

Executive summary

The most useful pattern this week is not a single bug. Four unrelated agent products, published in the last few days, share the same defect: the agent has a shell or an administrative API, and the control that was supposed to stand between a prompt and that capability is missing or defaults to yes when no human is attached. These are the agents that run unattended (alert triage, scheduled jobs, gateway-driven chat), which is exactly where the approval prompt has nobody to answer it.

The other fresh items are a critical Storybook flaw that treats a browser tab as a way into a developer’s machine, a third Agent Mesh advisory that comes with good news (the affected builds are old), and a provider-side update on the OpenCode Console breach.

Recommendation (opinion): ask one question of every autonomous agent you run: what happens to its shell tool when nobody is there to approve? If the answer is “it runs”, that is the finding, whatever its CVE number.

Act now

• Storybook: upgrade before the next storybook dev (details above).
• Unattended agents with a shell: inventory them and put approval, authentication and credential separation in front of the shell.

Vulnerabilities

Product	Flaw	Severity	Fixed in	Notes
Storybook (storybook, @storybook/addon-mcp and others)	No origin validation on the dev server preview; a website can edit story files (CVE-2026-114125)	Critical, CVSS 4.0 9.4	8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6	No known exploitation
piflow 2.0.0 to 2.0.1	Unauthenticated /chat runs the agent’s exec_shell tool (CVE-2026-109442)	Critical, 9.3	None referenced	Exposes LLM and database credentials
LangChat (through commit 2a6285a)	No auth interceptor; plaintext passwords, provider keys and admin creation reachable (CVE-2026-111704)	Critical, 9.3	None referenced	Published 16 Oct
OpenSRE (through 0.1.2026.10.19)	Headless approval gate always returns true; shell_run runs on injected alerts (CVE-2026-109444)	High, 8.7	None referenced	Published 20 Oct
LangAlpha (through 2026.09.07)	Indirect prompt injection to Bash and code execution, vault secrets exfiltrated (CVE-2026-109440)	High, 8.6	None referenced	Published 20 Oct
CrewAI	Unsafe reflection when loading an agent from a repository (CVE-2026-92206, ZDI-26-706)	High, CVSS 3.0 8.8	Unknown	User must load a malicious configuration
crewai-tools through 1.15.28	SeleniumScrapingTool skips the private-address check (CVE-2026-112308)	High, 8.3	Referenced in pull request 6870	Published 19 Oct
Google Agent Mesh alpha.1 to alpha.8	Unauthenticated GET /enroll/status returns a peer’s signed token (CVE-2026-103090)	High, 8.8	0.1.0-alpha.9	Update: third advisory
Hermes Agent (Nous Research)	Webhook session ID parsing lets a colon in a route name inherit a higher-privileged route’s toolsets (CVE-2026-114463)	Not scored	Merged in main 18 Sep; release not stated	Needs the weaker route’s HMAC secret
IBM Langflow 1.0.0 to 1.12.4	Three message endpoints lack ownership checks (CVE-2026-107366)	High, CVSS 3.1 8.3	See IBM bulletin	Authenticated user; can overwrite another user’s messages
Pydantic AI Harness CodeMode before 0.59.0	Nested tool calls skip tool_calls_limit (CVE-2026-114386)	Moderate, 6.3	0.59.0	Cost and side-effect control
djust	Arbitrary absolute-path file read through an MCP tool (CVE-2026-113731)	Low	Not stated	Published 21 Oct

Unattended agents: the approval gate that approves nobody

ResearchCVSS 8.6 to 9.316 to 21 Oct

What happened. Four advisories describe agents whose dangerous tool is reachable without a person. In piflow 2.0.0 to 2.0.1, POST /chat and /chat/stream need no authentication, and a request can tell the DeepAgents chat agent to call exec_shell, which runs commands with no allow-list or approval (CVE-2026-109442, 9.3). In OpenSRE through 0.1.2026.10.19, the headless presenter’s execution_allowed() always returns true, so shell_run executes without confirmation, and alerts or Slack messages the agent triages can carry the instruction (CVE-2026-109444, 8.7). In LangAlpha through 2026.09.07, web content the agent retrieves can lead it to the Bash and ExecuteCode tools, which have neither an allow-list nor human approval, and to a vault secrets file in the sandbox (CVE-2026-109440, 8.6). LangChat through commit 2a6285a registers no authentication interceptor, so unauthenticated callers can read plaintext passwords and provider API keys, and create super-admin accounts (CVE-2026-111704, 9.3). None lists a patched version in the GitHub entry. None is marked exploited; Lasso’s database entry for OpenSRE (seen as a search extract) says “Known exploit: No”.

Analysis. The entry point differs: a public HTTP route in piflow and LangChat, injected content in OpenSRE and LangAlpha. The root cause is the same. A control that exists for interactive use (the approval prompt) was never given a defined behaviour for non-interactive use, and the default for “no one to ask” was “proceed”. The trust boundary crossed is between untrusted text (an alert, a web page, a request body) and a host shell that inherits the process environment, which in these products holds LLM keys, Slack tokens and cloud credentials. Preconditions are low: for piflow and LangChat a network path to the service, for the other two the ability to put text in front of the agent. Blast radius is the host and every secret in its environment. Mappings: OWASP LLM01 prompt injection and LLM06 excessive agency; OWASP Agentic Top 10, tool misuse and identity and privilege abuse; ATLAS, prompt injection to execution. Compare the Vibe-Trading chain in the 21 Oct brief (injection to root shell) and the Langchain-Chatchat unauthenticated shell endpoint of the same day: the same two shapes, now in four more products. The OpenSRE case is also the clearest example I have seen of a safe-by-design interface (an approval gate) defeated by a headless code path that was never tested with the gate on.

Why it matters. Alert-driven SRE agents, scheduled research agents and gateway chatbots are the deployments where teams most want autonomy, so they are the ones most likely to run with approval off. The cost of the missing control is not a bad answer; it is code execution next to the credentials that make the agent useful.

Mitigation and detection. Make the no-human branch fail closed: a shell or code tool should refuse to run, or run in a sandbox with no credentials, unless an explicit allow-list matches. Put authentication and a network allow-list in front of every agent HTTP route. Keep provider and cloud keys out of the agent process environment; use scoped, short-lived credentials. Treat alert text, tickets, Slack messages and fetched pages as untrusted input. Detect shell or code-tool calls from non-interactive sessions, unexpected outbound connections from the agent host and new admin accounts in agent consoles.

Recommendation (opinion): test every unattended agent with the approval setting you actually deploy. Run one injected alert through it in staging, and treat “it executed” as a release blocker.

Sources: GHSA-9925-27m4-6rvp (piflow) · GHSA-fqh3-76w5-5vvf (OpenSRE) · GHSA-fcmr-j7xj-36vp (LangAlpha) · GHSA-hgqj-chvw-c4p5 (LangChat) · Lasso Security vulnerability database entry for OpenSRE (search extract, page not opened)

Storybook: a browser tab as a way into the developer machine

OfficialCVSS 9.421 Oct

What happened. GHSA-f2ph-cmg5-wxc8 (CVE-2026-114125) says a malicious website can interact with the preview of a running Storybook development server and cause changes to story files. If a changed file is later run by a local runtime, the attacker executes code with the developer’s permissions. It affects the storybook, @storybook/core, @storybook/addon-vitest and @storybook/addon-mcp packages in the 8.x, 9.x, 10.x and 11.0.0-alpha lines, and is fixed in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6. The advisory says there is no known exploitation, and that headless or MCP-client use and built Storybooks are not affected.

Analysis. The entry point is a web page the developer has open while the dev server runs; the boundary crossed is browser to localhost, the same one that any local MCP server bound to localhost has to defend. The fix is telling: cross-hostname iframe embedding is now disabled by default and postMessage is restricted to the preview’s own origin and localhost, so the root cause was a message channel that accepted any origin. The precondition is that the dev server is running and the victim visits the attacker’s page, which is realistic for developers browsing while working. The blast radius is the developer machine and whatever tokens it holds. The advisory does not describe an agent-driven path, but an MCP addon in the same dev server is exactly the kind of component coding agents are pointed at, which is why it is in this brief. OWASP LLM03 (supply chain) and the Agentic Top 10 tool-misuse category are loose fits; the closest analogue is the Trigger.dev --mcp dev server covered on 21 Oct.

Why it matters. Dev tooling that gained an MCP endpoint for agents inherits a larger attack surface than the same tool had a year ago, and developers run it with their full credentials.

Mitigation and detection. Upgrade, then re-test any tooling that depended on cross-host iframes (the Chromatic Visual Tests addon needs 5.5.1 or later). Do not run dev servers while browsing untrusted sites in the same profile, or bind them to loopback and use a separate browser profile for development. Review story-file diffs before running them.

Recommendation (opinion): upgrade today; it is a one-line fix with limited compatibility cost. Add dev-server MCP endpoints to your inventory of local agent attack surface.

Sources: GHSA-f2ph-cmg5-wxc8

Google Agent Mesh: the third advisory, and a correction to my urgency

OfficialCVSS 8.8Update · 22 Oct

What happened. GHSA-xhg2-hv24-f4rp (CVE-2026-103090, published to GitHub’s database on 22 Oct) says the enrolment status handler GET /enroll/status has no authentication and protects credentials weakly. An unauthenticated attacker can take a peer ID from the public GET /info endpoint and fetch that peer’s signed Biscuit identity token, then replay it as a bearer credential to read mesh policies and overwrite router addresses. A related flaw in POST /enroll lets any holder of a bootstrap token re-fetch another peer’s credential. Affected: 0.1.0-alpha.1 to alpha.8; fixed in alpha.9, which requires proof of possession of the enrolment private key, adds rate limiting and validates router lease addresses.

Analysis. The release pages of the google/sam repository, where the project’s builds are published, show the alpha line running from 26 June to at least 6 August, release candidates from 23 September, v0.1.0 on 16 October and v0.1.1 on 18 October. So all three advisories (this one, CVE-2026-103091 and CVE-2026-102503) describe builds at least a month old, and the current release adds operator-owned signing keys, deny-by-default publishing, authenticated gossip and a rule that nodes re-enrol only under a control-plane key they already trust. That changes my recommendation from 21 October: the action is to confirm nobody runs an alpha, not to treat a current deployment as exposed. The three advisories together are still a good case study in an identity layer whose first public builds returned a credential to anyone who knew an identifier.

Why it matters. A leaked mesh identity token is a bearer credential for the agent network. Teams that tried the alpha on a shared network may have left enrolled peers behind.

Mitigation and detection. Check for alpha builds and move to v0.1.1. If you ran a reachable alpha, rotate mesh credentials and review which peers are enrolled. Alert on GET /enroll/status or /policies requests from addresses that are not enrolled peers.

Recommendation (opinion): upgrade and rotate if you ever exposed an alpha router; otherwise this is housekeeping.

Sources: GHSA-xhg2-hv24-f4rp · google/sam releases · google/sam releases, page 3

Shorter items

Official15 to 22 Oct

• CrewAI agent loading (CVE-2026-92206, CVSS 3.0 8.8). The load_agent_from_repository function does not restrict a user-supplied argument before using it to import a module, so loading a malicious agent configuration runs code as the service account. The advisory cites Zero Day Initiative ZDI-26-706 and lists no fixed version. Control: only load agents from repositories you own, and pin them.
• crewai-tools SeleniumScrapingTool SSRF (CVE-2026-112308, 8.3). Through 1.15.28 the tool never applies the private-address check, so a prompt-injected URL can send headless Chrome to loopback, RFC 1918 or cloud metadata addresses. A fix is referenced in CrewAI pull request 6870. Control: block metadata addresses at the network layer for any agent that browses.
• Hermes Agent webhook toolset confusion (CVE-2026-114463). The gateway builds a session ID from the route name and delivery ID and recovers the route by splitting on a colon, so a route called build:external could inherit the toolsets of build, including terminal and file tools. The fix, merged on 18 September (pull request 115285, tagged security, medium), looks the route up from the authenticated URL segment. The CVE was published 21 October and the fixed release is not stated in the advisory. I have not established that this is the Hermes in the toolchain covered on 20 Oct.
• IBM Langflow (CVE-2026-107366, 8.3). Three message endpoints lack ownership checks in 1.0.0 to 1.12.4, so a logged-in user can delete or overwrite another user’s messages and take over a session. Overwritten messages are an injection route into a later agent run. See the IBM bulletin.
• Pydantic AI Harness CodeMode (CVE-2026-114386, 6.3). Before 0.59.0, tool calls made from inside sandboxed code skip UsageLimits.tool_calls_limit, so a prompt-injected program can exceed the operator’s limit. Fixed in 0.59.0.
• Drupal AI CKEditor (CVE-2026-96392). Template-engine injection up to 1.4.3, published 22 Oct with no score; Drupal’s advisory SA-CONTRIB-2026-187 carries the fix. Drupal AI and AI Translate also received missing-authorization CVEs on 22 Oct (CVE-2026-84912, CVE-2026-84913) that I did not read in full.

Sources: GHSA-pgwr-r23p-38mr · GHSA-5595-9g9c-5cc4 · GHSA-4h98-2jhp-qgm2 · Hermes pull request 115285 · GHSA-qf42-fp6f-25w9 · GHSA-3589-pxp7-3gj8 · GHSA-xxh3-46q2-4vrc

Incidents

OpenCode Console: providers respond

PressEarly · pages not openedUpdate · 17 to 19 Oct

What happened. Search-result extracts from several outlets (TechCrunch dated 19 October, BleepingComputer, The Hacker News, Infosecurity Magazine and others) add to the 21 Oct account. They say OpenCode’s co-founder Dax Raad stated that the open-source app and CLI were not affected because the provider keys “never come to us”; that Anthropic and Google blocked the API keys they believed exposed; and that OpenAI worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode says refunds for unauthorized charges are under way. The company is still described as not having said what the legacy system was, how it was reached or how many users 1.4% represents. I could not open any of these pages from this environment, so this stays press-level.

Analysis. The new fact is that three providers acted on the keys themselves, which suggests the keys were reachable in bulk and that the abuse was large enough to be visible to the providers, consistent with the “distillation” framing. It also means that if you were affected, a key may already have been blocked and your application may be failing for that reason.

Why it matters. Provider-side revocation is now part of the response to a third-party key-vault breach, which you cannot rely on to be complete or fast.

Mitigation and detection. Unchanged from yesterday: rotate at each provider, set spend limits, review usage since 17 October, and check whether production calls started failing with authentication errors.

Recommendation (opinion): if you used the Console and received no email, still rotate. Notification coverage in the first days of a breach is rarely complete.

Sources: Search extracts from TechCrunch, BleepingComputer, The Hacker News and Infosecurity Magazine (pages not opened) · OpenCode issue 56703

Research and policy

No new research or policy item in the window passed the inclusion test. Searches for arXiv papers, OWASP, MITRE ATLAS, NIST and EU AI Act developments returned only items from earlier in 2026 (the EU omnibus deal that defers high-risk obligations, NIST’s agent-standards initiative and the OWASP 2026 list), none dated inside the window and none read in full.

Related reports

• Security brief, 21 Oct 2026: Agent Mesh first two advisories, vLLM, A2A Java.
• Daily signal, 22 Oct 2026: approval design in MCP and Agent Mesh’s hardening releases.
• Security brief, 20 Oct 2026: the Hermes, Cairn and Strix toolchain.