fix: Port tool confirmation security and re-validation fixes to v1 - #6575
Merged
Conversation
xuanyang15
reviewed
Aug 3, 2026
An attacker who could manipulate or inject events into the session history could execute unauthorized tools by forging a tool confirmation response. This fixes the vulnerability by: - When resolving confirmation targets, the processor verifies if the tool is registered in the executing agent's tools_dict - Validate that the tool actually requires confirmation, supporting both static definitions and dynamic confirmation requests - Verify that the original tool call event exists in the session history with the matching ID, and that its name and arguments match the confirmation request's originalFunctionCall exactly to prevent argument tampering. Co-authored-by: Xuan Yang <xygoogle@google.com> PiperOrigin-RevId: 953540969 Change-Id: Iff6e8c861605fafafce4985ee9a269274d6d789c
Co-authored-by: Xuan Yang <xygoogle@google.com> PiperOrigin-RevId: 956611754
wukath
force-pushed
the
backport-tool-confirmation-fixes-v1
branch
from
August 5, 2026 18:48
4df0ee1 to
7801db0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR ports two tool confirmation fixes to the
v1branch:fix: Prevent continuation forgery in tool confirmation(PiperOrigin-RevId: 953540969)tools_dict.fix: Stop re-validating already-consumed tool confirmations(PiperOrigin-RevId: 956611754)