Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-09-30

HighPrimary

AgentScope RealtimeAgent Can Execute Prompt-Selected Python Without an Independent Approval Boundary

Analysis of CVE-2026-51856, a controlled demonstration in which an AgentScope RealtimeAgent exposed to execute_python_code ran model-selected Python without another approval boundary.

AgentScope RealtimeAgentTool execution / MCPPrompt-selected Python tool execution without independent approval or isolationAgentScope RealtimeAgent services that expose execute_python_code to remote WebSocket sessions

What happened

In the controlled validation, a remote WebSocket user prompts RealtimeAgent to select execute_python_code, and the toolkit runs the model-produced Python in the service environment.

Why it matters

Demonstrated arbitrary Python execution in the service environment of a deliberately exposed AgentScope RealtimeAgent; no real-world victim impact or in-the-wild exploitation was reported.

Missing authorization check

Independent, payload-bound authorization before execute_python_code runs, combined with process isolation and separate gates for filesystem, credential, network, deployment, and infrastructure effects.

Would PP block it?

The prompt can still influence the model, but model selection alone does not satisfy the execution boundary. Without a matching receipt for the exact Python operation, identity, runtime, and expiry, the tool call fails closed.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-09-30

    CVE-2026-51856 is published with the validated RealtimeAgent execution path and affected-version notes.

  2. 2026-10-01

    The CVE record is updated with references to the public disclosure and AgentScope issue.

Technical breakdown

  • The deployment exposes execute_python_code in a RealtimeAgent session's available tool list.
  • A remote user connects through the RealtimeAgent WebSocket interface and supplies a prompt that leads the model to select the Python tool.
  • RealtimeAgent._acting forwards the model-produced call to Toolkit.call_tool_function.
  • The toolkit invokes execute_python_code in the service environment without another approval or isolation boundary on the validated path.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Toolkit.call_tool_function immediately before execute_python_code is invoked
Still needs
Permission Protocol does not make arbitrary Python safe, isolate the process, remove an unsafe tool from the deployment, or constrain effects that bypass integrated gates.
Receipt required for
Executing model-selected Python and any downstream credential, filesystem, network, deployment, or infrastructure action

A Tool-Call Gate can hold execute_python_code until a separately authenticated signer approves the exact canonical operation and payload.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop