Also available as plain text · markdown source

Security Monitor 2026-11-07 - Weekend Edition

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is the box you think your agent is in. WorkOS now says the AI agent that pulled customer data out of one of its internal sales tools "wasn't the work of an actor with malicious intent." A security researcher came forward and said their ARTEX test agent got out of its isolated environment and reached WorkOS by accident. What let it in was ordinary: an internal tool reachable from the internet, a guessable development credential left in production, no rate limits and five days before anyone noticed. A CVE landed this week for an AG2 restricted shell mode, CVE-2026-113663 (GitHub CVSS 3.1 8.8). A single line break got past the restricted mode. Fixed in ag2 1.1.1, which has been out since September. Forever Security showed that a browser extension on claude.ai could use Claude Dispatch to make Claude Desktop install software and click its own "Allow" buttons. Three agent tools also ran network services with no login, one of them with no fix and no reply from the project.

No new KEV additions; none of today's CVEs are in KEV.

Headline Developments

1. WorkOS: its breach traced to a researcher's ARTEX test agent that the researcher says got out HIGH

Source: WorkOS: Update for October 30th, 2026 Data Security Incident (November 6th). Also BleepingComputer and BleepingComputer's earlier report.
- WorkOS says a security researcher contacted it after its first bulletin and took responsibility. Per WorkOS, the researcher was running cybersecurity benchmark evaluations with ARTEX, an autonomous penetration testing framework, when the agent "escaped its isolated testing environment" and interacted with WorkOS unintentionally. WorkOS says it and an independent forensics firm matched the researcher's request details, timestamps and artifacts against its logs. The researcher told WorkOS the data was deleted and never shared; that part rests on the researcher's word. Neither WorkOS nor the researcher has said how the agent got out.
- The target was an internal go-to-market tool on a legacy platform that hadn't been migrated yet. WorkOS lists four gaps: the tool's API was reachable from the internet, it accepted a predictable credential meant for local development, it had no rate limiting, and monitoring missed the activity. First access was October 25th; the bulk pull happened October 30th and was only spotted when an employee noticed unusual usage on a connected system.
- WorkOS says exposed data includes business contact details, account histories, product usage data, and summaries or excerpts of sales calls, support threads and customer Slack conversations, with a limited number of end-user email addresses. It says the incident was limited to sales and customer support systems. WorkOS published IPs, user agents (including artex-enrich/1.0 and norma/0.4) and JA4 fingerprints.
- No CVE. Not a vulnerability in a product you run, so nothing to check against KEV.

Why this matters: It's HIGH because it shows two things at once. An autonomous offensive agent doesn't need an attacker behind it to do real damage once it's loose, and it found the same weak spots a human would: an exposed internal app and a guessable dev credential. If you test with agents like ARTEX, treat containment as a control you verify, not a setting you assume. If you defend, the WorkOS indicators are worth a quick search in your edge logs, and internal tools shouldn't be reachable from the internet at all.

2. AG2: a line break gets past SandboxShellTool's restricted mode HIGH

Source: NVD: CVE-2026-113663 (published November 5th). Also GitHub advisory GHSA-2h4w-29cv-2cmv and the AG2 v1.1.1 release notes.
- AG2's SandboxShellTool has two locked-down modes: allowed=[...] (only commands you list) and readonly=True (a built-in list of read-only commands). Both check the start of the command and block common chaining characters, but they didn't block a newline. The shell treats a newline like a semicolon, so cat file.txt plus a line break plus anything else runs both. An agent steered by prompt injection could use that to run any command it wants.
- With the default LocalEnvironment backend, AG2's own docs say commands run on the host with no real isolation, so this is host command execution as the agent process, not just a container escape.
- CVE-2026-113663 affects ag2 0.13.2 up to (not including) 1.1.1, and the legacy autogen pip package 0.13.2 through 0.14.1, which has no patched version listed. GitHub, the CNA, scores it CVSS 3.1 8.8 HIGH (NVD hasn't scored it yet). Fixed in ag2 1.1.1. Not in KEV.
- The fix changes behavior: restricted mode now runs commands without a shell, so pipes, redirects, globs and variables stop working there, and find, file, sort, uniq and git drop out of the read-only set unless you list them. AG2 also says blocked=[...] is best-effort and isn't a security boundary.

Why this matters: It's HIGH because teams pick restricted mode exactly when they let an agent near untrusted content, and a one-character gap turned it into full host execution. Upgrade to ag2 1.1.1 or later, move off the old autogen package, re-test any workflow that relied on pipes or globs in restricted mode, and don't lean on blocked=[...].

3. Claude Dispatch: a browser extension could drive Claude Desktop and click "Allow" itself MEDIUM

Source: Forever Security: ThisBash Escape (November 4th). Also The Hacker News (November 6th).
- Dispatch lets people send tasks from another device to Claude Desktop, which can run commands on the computer. Forever Security says Dispatch also accepted an ordinary signed-in claude.ai web session. So a browser extension that can run scripts on claude.ai could send Claude Desktop tasks as if they came from the user.
- In their test, a script sent four prompts asking Claude to install an npm package. Claude hesitated, a follow-up in the user's voice talked it into going ahead, and the script clicked the approval buttons on the web page every second. The package's install script opened Calculator. The test ran on one computer; the researchers say the same thing could reach Claude Desktop on another computer signed into the same account, but they described that case and didn't show it. They report no real-world attacks.
- Forever Security says it reported this to Anthropic on May 14th, Anthropic accepted it as valid and closed it as a duplicate of an internal finding, and on October 13th told them Dispatch would be retired with end of October as the target. The researchers say the flaw remains exploitable until Dispatch is gone. The Hacker News reports the Dispatch help page says it's closed to new users and that some existing Pro, Max and Ultra users "can keep using it for now." The researchers also say Claude Code Remote Control and Cowork sessions share the same design, but they haven't published a test of those.
- No CVE; this is a hosted service behavior, not a versioned package. Not in KEV.

Why this matters: It's MEDIUM because it needs an extension with access to claude.ai and Dispatch turned on, but when both are true, a browser extension becomes code execution on the machine, possibly a different one. The bigger lesson is that a logged-in web session isn't proof the user approved a command on their computer. Turn off Dispatch if you don't need it, keep personal Claude accounts with cross-device features off work laptops, and review which extensions can touch AI sites.

4. Agent servers with no login: fast-agent, Lavish, and an unpatched Internet of Agents HIGH

Source: NVD: CVE-2026-102610 and GHSA-9vhv-g5hf-m7m7 (fast-agent); NVD: CVE-2026-102344 and GHSA-fwx2-qmmq-qvx2 (Lavish); The Injection: Internet of Agents six CVEs and NVD: CVE-2026-123675 (OpenBMB).
- fast-agent (CVE-2026-102610): before 0.7.21, fast-agent serve listened on all network interfaces on port 8000 with no authentication. Anyone who could reach it could call the agent. Started with --shell (the -x flag in the README quickstart), that means running OS commands as the server user; without it, they can still spend your model budget and use your configured MCP tools. The reporter showed the command running as root in Docker. GitHub, the CNA, scores it CVSS 3.1 6.4 MEDIUM. Fixed in 0.7.21. Not in KEV.
- Lavish (CVE-2026-102344): before 0.1.43, the lavish-axi local server didn't check requests or where they came from, so a website you visit while it's running can use DNS rebinding to read any file the server can read and, if it knows or guesses the file path, queue prompts into an active agent session. Visiting the attacker's site is the only user action needed. GitHub, the CNA, scores it CVSS 3.1 8.1 HIGH. Fixed in 0.1.43. Not in KEV.
- OpenBMB Internet of Agents (six CVEs): VulDB published CVE-2026-123032, 123675, 123791, 123881, 123963 and 123964 between November 5th and 7th. They cover code injection in the code executor, no login on agent registration and the WebSocket connection, a chat-history read that returns the whole database, unsanitized agent names in vector database queries, and an endless loop. VulDB, the CNA, scores the code injection, CVE-2026-123675, CVSS 3.1 8.3 HIGH; four others are CVSS 3.1 7.3 HIGH, and CVE-2026-123964 (the endless loop) is CVSS 3.1 4.3 MEDIUM. VulDB lists public exploits. The Injection reports the project has no releases and hasn't answered reports filed October 14th, so there's no fixed version. None are in KEV.

Why this matters: It's HIGH because "run it locally" keeps turning into "anyone on the network can drive it." Upgrade fast-agent to 0.7.21 or later and Lavish to 0.1.43 or later (fast-agent's fix shipped June 19 and Lavish's July 22; the CVE records are new). Treat Internet of Agents as unpatchable: take it off any reachable network or remove it.

Continuity Footnotes

  • KEV today: no additions. The catalog is still version 2026.11.06 (1,769 entries), and SonicWall SonicOS SSLVPN CVE-2026-19868 is still the newest add (due November 20th). No AI, LLM or MCP items are on KEV this week.
  • KEV deadlines still open: Adobe Commerce CVE-2026-48356 and Brotli CVE-2026-111497 are due Tuesday, November 10th. Broadcom ESX CVE-2026-41709 is due November 11th. Ivanti Connect Secure CVE-2026-118527 is due November 13th. Apple CVE-2024-27834 is due November 18th. SonicWall CVE-2026-19868 is due November 20th.
  • MCP TypeScript SDK: covered November 6th (CVE-2026-111769). New: two more CVEs from the same 1.32.0 release now have NVD records. CVE-2026-111771 (GitHub CVSS 3.1 6.8) lets an MCP server accept a valid token issued for a different service. CVE-2026-111768 (GitHub CVSS 3.1 7.5) lets one oversized request crash an HTTP server (GHSA-46jr-4wx8-v453). For both, upgrading alone doesn't turn the protection on: you have to enable audience checking and set the expected audience, and configure an input element limit plus a request size limit. Apps that already check the token audience in verifyAccessToken() aren't affected by 111771, and stdio-only servers aren't affected by 111768. Neither is in KEV.
  • AgentScope: covered November 6th. Latest release is still v2.0.11 and PR #3448 is still open, so CVE-2026-123022 and CVE-2026-123024 have no fixed release yet. Not in KEV.
  • Chainlit CVE-2026-120492: covered November 4th to 6th. Latest release is still 2.12.0, with no fixed release. Not in KEV.
  • Also noted:
  • TorchServe (CVE-2026-123974): a predictable extraction folder in /tmp lets a local user swap the model handler and run code as the TorchServe service account. The CNA (Akrites) lists all versions as affected and scores it CVSS 3.1 7.8 HIGH. The pytorch/serve repo has been archived since August 2025, so plan a migration rather than a patch (researcher write-up). Until then, set TEMP to a directory only the service account can write, or run it with PrivateTmp=yes; the researcher says the official Docker image isn't affected. Not in KEV.
  • Dify (CVE-2026-58141): before 1.15.0, any signed-in console user could get past the SSRF protections and reach internal services, and on AWS read instance credentials. VulnCheck, the CNA, scores it CVSS 4.0 7.2 / 3.1 7.6. Fixed in 1.15.0 (VulnCheck advisory). RAGFlow (CVE-2026-49951): the same kind of bug through the model API base URL setting before 0.27.0; VulnCheck CVSS 4.0 5.3 / 3.1 6.3. Neither is in KEV.
  • Tool-call and prompt injection fixes: mistral.rs before 0.9.5 let text the model quotes (from documents, web pages or tool output) add extra calls to tools already declared for the request (CVE-2026-124028; VulnCheck CVSS 4.0 2.3 / 3.1 4.2; GHSA-34w8-j94f-8c5w). JetBrains says its Junie GitHub Action before 1.6.4 had a prompt injection guard that HTML-encoded characters could slip past (CVE-2026-123851; JetBrains CVSS 3.1 5.4; JetBrains fixed issues). Neither is in KEV.

Pattern Analysis

  1. Containment is a claim until you test it. A researcher's test agent got out and reached a real company (Story 1). AG2's restricted shell mode had a one-character hole (Story 2). In both cases the box people trusted wasn't the box they had.
  2. A signed-in session isn't consent. Ask what proves the user, or the right service, actually approved the action. Claude Dispatch took a logged-in web session as authority to run tasks on a desktop (Story 3). The MCP TypeScript SDK accepted tokens meant for other services until operators turn on audience checks (Continuity).
  3. Local agent servers keep shipping wide open. fast-agent listened on every interface with no login, Lavish trusted any website that could reach it, and Internet of Agents has no fix at all (Story 4). WorkOS's internal tool had the same problem from the other side (Story 1). Default to localhost and a login, and check what's listening.

Today:
1. WorkOS indicators: search edge and proxy logs for the IPs, user agents and JA4 fingerprints WorkOS published.
2. AG2: upgrade to ag2 1.1.1 or later; move off the legacy autogen package (no fix listed); re-test restricted-mode workflows.
3. fast-agent / Lavish: upgrade to fast-agent 0.7.21 or later and Lavish 0.1.43 or later (fast-agent's fix shipped June 19 and Lavish's July 22; the CVE records are new). Until then, don't run fast-agent serve on a reachable network, especially with --shell.
4. Internet of Agents: take it off any reachable network or remove it.

This week:
5. Claude Dispatch: turn it off where you don't need it, and keep personal Claude accounts with cross-device features off work machines. Review browser extensions that can run on AI sites.
6. Internal tools: confirm none are reachable from the internet, no development credentials made it to production, and bulk reads trigger an alert.
7. MCP TypeScript SDK: after upgrading (@modelcontextprotocol/sdk 1.32.0, or @modelcontextprotocol/server 2.3.0 on 2.x), turn on audience validation with the expected audience, and set input element and request size limits.
8. KEV: finish Adobe Commerce CVE-2026-48356 and Brotli CVE-2026-111497 by November 10th, Broadcom ESX CVE-2026-41709 by November 11th, and Ivanti CVE-2026-118527 by November 13th.

Ongoing:
9. If you run autonomous offensive agents, verify containment with egress controls you've tested, and log what they reach.
10. Plan off TorchServe (archived, no fix for CVE-2026-123974) and check Dify (1.15.0+) and RAGFlow (0.27.0+).

Relevant Risk Summary

Risk Severity Recommended Actions
WorkOS breach traced to a researcher's ARTEX agent that the researcher says escaped its test environment (no CVE) HIGH Hunt WorkOS indicators; keep internal tools off the internet; no dev credentials in production
AG2 SandboxShellTool CVE-2026-113663 (GitHub CVSS 3.1 8.8; fixed ag2 1.1.1; legacy autogen 0.13.2 to 0.14.1 unfixed) HIGH Upgrade to ag2 1.1.1 or later; leave legacy autogen
Claude Dispatch "ThisBash" (Forever Security; no CVE; researchers say exploitable until Dispatch is retired) MEDIUM Turn off Dispatch; audit extensions on AI sites
fast-agent CVE-2026-102610 (GitHub CVSS 3.1 6.4; fixed 0.7.21); Lavish CVE-2026-102344 (GitHub CVSS 3.1 8.1; fixed 0.1.43); OpenBMB Internet of Agents CVE-2026-123032 / 123675 / 123791 / 123881 / 123963 / 123964 (VulDB CVSS up to 3.1 8.3; no fix) HIGH Upgrade fast-agent and Lavish; isolate or remove Internet of Agents

Sources