Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-21

HighPrimary

Vibe-Trading Agents Can Execute Prompt-Selected Shell Commands and Staged Backtest Code

The Vibe-Trading researcher advisory documents runtime tests and session-level reproducers for BashTool and BackgroundRunTool executing agent-selected.

HKUDS Vibe-TradingGovernance bypassControlled agent-action researchAgent shell dispatch and backtest module-loading boundary

What happened

Invoking shell tools and executing staged Python through the backtest workflow without independent action approval

Why it matters

Researcher-confirmed container command execution and file artifacts; no production financial loss or host escape established.

Missing authorization check

Independent authorization for invoking shell tools and executing staged Python through the backtest workflow without independent action approval

Would PP block it?

The enforcement point would need to verify the caller, resolved operation, target, parameters and approved task before execution. This is a conditional assessment, not a demonstrated PP prevention result for this case.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-21

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • The Vibe-Trading researcher advisory documents runtime tests and session-level reproducers for BashTool and BackgroundRunTool executing agent-selected commands as root in the container. A separate write-then-backtest path executes staged Python before checking its SignalEngine class. The report also describes an uploaded-document injection that makes the agent emit a shell call. These are controlled execution demonstrations, not evidence of stolen investments or live trading losses.
  • Invoking shell tools and executing staged Python through the backtest workflow without independent action approval
  • Researcher-confirmed container command execution and file artifacts; no production financial loss or host escape established.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Agent shell dispatch and backtest module-loading boundary
Still needs
PP does not repair the underlying application or sandbox, infer valid authority from a prompt, or cover direct effects that bypass an integrated gate. Separate isolation and least-privilege controls remain necessary.
Receipt required for
Invoking shell tools and executing staged Python through the backtest workflow without independent action approval

An independent authorization boundary could hold the described operation when the exact action is routed through an integrated enforcement point.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop