Skip to content

v0.8.33 — Tool-output trust-boundary guard (Agentjacking class)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 16:45
v0.8.33
2941d3e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

feat(policy): add tool-output trust-boundary guard for Agentjacking-class untrusted-output injection

The mirror of every existing Airlock layer: those guard the input side of the tool seam; this guards the output side — a tool/MCP result about to flow back into the agent's context, treated as untrusted data rather than instruction (OWASP-MCP MCP08).

Threat model — two reference cases:

  • Agentjacking (Tenet Security, disclosed 2026-06-12; Sentry mitigation 2026-06-18) — a vulnerability class, NO CVE ID. A fake Sentry error (public DSN) is fed to an AI coding agent by the Sentry MCP server; the agent runs the attacker's "resolution steps" shell commands. System-prompt "distrust external data" did not stop it — hence a code-level output trust boundary.

  • CVE-2026-42824 "SearchLeak" (M365 Copilot Enterprise, Varonis, disclosed 2026-06-15) — Parameter-to-Prompt injection; untrusted output reaches the model as instruction.

  • ToolOutputTrustGuard (tool_output_trust_guard.py): inspect(output) flags override directives, imperative command directives, fenced shell commands (the Agentjacking "resolution steps" shape), and tool-call-shaped JSON in diagnostic/error fields. process(output) STRICT-default wraps the result in a delimited untrusted-data envelope (treat as data, never instructions). Never executes, never silently drops. Flags emit a structured event bridged to OTel. Zero-dep core.

  • policy_presets.untrusted_tool_output_defaults() + the UNTRUSTED_TOOL_OUTPUT preset constant — opt in per tool (severity=high, default_action=flag_and_envelope, owasp=MCP08).

  • 18 tests; built-wheel smoke confirms a forged "resolution steps" output is flagged + enveloped and a benign result is not. Pydantic-only, zero-dep core. (#101)

Sources: https://labs.cloudsecurityalliance.org/research/csa-research-note-agentjacking-mcp-sentry-injection-20260612/ · https://www.varonis.com/blog/searchleak

Assets 2
Loading