What happened
The orchestrator invoked cron_add, saved the tested shell command and returned success without a pending approval; the scheduler subsequently executed it.
2026-10-09
CriticalPrimaryOpenHuman Agent Created an Unapproved Persistent Shell Job From an Inbound Message
A controlled OpenHuman demonstration reported an inbound-channel agent creating a persistent shell job without approval and a scheduler executing a prepared helper.
OpenHumanTool execution / MCPControlled demonstration of unapproved persistent shell scheduling and helper executionOpenHuman 0.54.15 test environment with a connected Telegram channel and a helper pre-positioned in the working directory
Why it matters
A host-side canary write and persistent shell-job creation were reported in the test. Broader compromise of data accessible to the runtime user is potential impact, not demonstrated victim damage.
Missing authorization check
Independent authority for the exact persistent job, command, execution environment and subsequent scheduled execution.
Would PP block it?
Bind authority to the schedule, command and helper-affecting environment variables. Deny unmatched scheduled execution rather than inheriting authority from an inbound message. The disclosure did not test PP.
Incident analysis
Timeline and technical read
Timeline
2026-10-09
Vendor-hosted advisory published; versions before 0.57.13 listed as affected and 0.57.13 as patched.
Technical breakdown
- The reported reproduction connected an inbound Telegram channel and pre-positioned git_ssh_wrapper.sh in the working directory.
- The advisory supplies a tested cron_add model tool call using GIT_SSH with an otherwise allowed git command.
- Runtime evidence reports cron_add success and an empty pending-approval list.
- The scheduler executed the stored command through sh -lc; the prepared helper wrote a canary containing success.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- cron_add persistence and scheduler process-execution boundaries
- Still needs
- PP does not fix shell parsing or command validation, provide a perimeter defense, or explain how the helper could be planted remotely. Unmediated scheduler paths remain uncovered.
- Receipt required for
- Creating or changing a persistent shell job and executing its exact command and environment
A separately integrated gate could require approval for both job creation and execution, but coverage depends on mediating both paths.
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.