What happened
A security flaw in the agno agent framework affects the exec function of the Agent Orchestration Layer: manipulating the 'code' argument yields dynamically-managed code execution with no confirmation gate. It is remotely exploitable, the exploit has been released publicly, and the vendor fix pull request was still awaiting acceptance at disclosure time, so affected deployments had no patched release to upgrade to.
Why it matters
Agent frameworks that execute LLM-derived code are a prime RCE vector: if any prompt-injected or otherwise attacker-controlled input reaches the exec orchestration layer, it is direct code execution on the host, possibly with the agent's elevated privileges. With an unfixed, publicly-released exploit, this needs immediate mitigation.
Attack vector
Remote attacker manipulates the 'code' argument passed to the exec function in the Agent Orchestration Layer, which dynamically manages code resources without a confirmation gate — resulting in arbitrary code execution. Public PoC published; the fix PR is pending acceptance (issue #10053, PR #10523).
Affected systems
agno (agno-agi) 3.0.0 through 3.1.1 (Agent Orchestration Layer, exec function)
Mitigation
No released fix at publication; track Agno PR #10523 and upgrade once a patched version lands. Restrict network exposure of agent orchestration endpoints and add a human approval gate on dynamic code execution.