What happened
NVD published CVE-2026-47211 (CVSS 8.4) on 2026-08-03, describing how Ouroboros — a local-first runtime that records and constrains AI coding-agent actions — could be tricked into executing arbitrary code purely by a developer cloning and running commands inside an attacker-crafted repository.
Why it matters
This is a supply-chain-adjacent attack vector directly targeting AI coding agent tooling: developers who clone untrusted repositories and run their AI-agent harness inside them can be compromised without any other interaction, a pattern increasingly seen across the agentic coding tool ecosystem.
Attack vector
Simply cloning a malicious repository and running Ouroboros commands within that directory can trigger arbitrary code execution, because the runtime's policy engine trusts repo-resident configuration/routing files it should treat as untrusted input.
Affected systems
Ouroboros (Q00/ouroboros) < 0.39.0
Mitigation
Upgrade to Ouroboros 0.39.0 or later (note: this fix was later found incomplete, see CVE-2026-66065; upgrade to 0.42.1+ for full remediation).