Omnigent bug lets AI coding agents bypass safety rules

Published September 2, 2026 CVE-2026-62676

Omnigent is a tool that runs AI coding agents like Claude Code and Codex while trying to keep them inside safety rules. A bug lets a misbehaving or tricked agent slip past those rules and push code to repositories it should not touch, or break out of its assigned work folder.

Severity
HighCVSS 3.1 · 7.1
Fix
Fixed in 0.3.0Fix recorded on Sep 2, 2026
Affected versions
before 0.3.0
Weakness
CWE-184
Exploit likelihood
0.30% in 30 daysEPSS, higher than 22% of known flaws
Affects
omnigent-ai/omnigent

How it works

Omnigent checks agent-issued shell commands with a parser that only recognizes certain command forms, and when a command is written a way it does not recognize, the tool treats that as no command at all and lets it through instead of blocking it.

What to do

Check the installed omnigent package version with python3 -m pip show omnigent and compare it against 0.3.0. Any versions older than 0.3.0 has the flaw, so update with python3 -m pip install -U omnigent to reach the fixed 0.3.0 release, which closes the parser gaps and makes the safety checks fail closed instead of open.

Run this in the application environment you want to check:

python3 -m pip show omnigent

There is no workaround short of upgrading, since the bug is in the shared command checker itself; update to omnigent 0.3.0 or later and confirm the version afterward.

Technical details

Affected software: omnigent-ai/omnigent

The shared parser in omnigent/policies/builtins/shell.py backs both the GitHub write_repos/write_branches allowlist and the working_dir workspace confinement policy. When it fails to parse a command, the policy evaluator returns None, which the framework treats as abstain, and abstain resolves to allow. Confirmed bypass forms include combined interpreter flags like bash -lc, unlisted wrapper commands such as timeout, nice, setsid, and stdbuf, command substitution, and an unsplit background operator.

Plain git push and env git push are still correctly denied, showing this is missing parser coverage rather than a broken allowlist. Fixed in 0.3.0 by making the gated surface fail closed.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Open in FIRST.org calculator

References

View Original Source