What happened
Lasso Security published CVE-2026-76066 on 2026-10-14 (CVSS 7.5; verified via the primary advisory with datePublished 2026-10-14). The executor validates a tool call against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware; stream.py sets is_private only for the owner, so WEB/API/TWITTER/TELEGRAM entrypoints get is_private=False while the private superset remains callable. A local harness reused IntentKit's wiring to demonstrate the bypass with a canary tool in place of a transfer.
Why it matters
This is a novel agent-permission-boundary failure with direct financial consequences: the model-visible tool-listing (the 'permission') is decoupled from the executor (the enforcement), so an attacker who can steer an agent via retrieved web content, a public chat, or thread replay reaches state-changing financial tools with no approval. It is representative of the class where agent advertise-only access control silently fails at execution time.
Attack vector
Tool visibility is advertise-only: ToolBindingMiddleware narrows the tool list shown to the model but the LangGraph ToolNode is built from the full private superset including always-present owner/system tools such as cdp_native_transfer, create_post and update_memory. A public caller (or indirect prompt injection in content the agent fetches, or checkpoint/history replay on a reused thread) that names an owner-only tool still gets it executed with no human-in-the-loop gate — enabling wallet transfers, DeFi swaps, postings and memory writes by a non-owner.
Affected systems
IntentKit <= 2.6.3 (intentkit/core/executor.py, middleware.py ToolBindingMiddleware)
Mitigation
No patched release confirmed yet (through 2.6.3 affected); Lasso Security advisory recommends: enforce tool availability at the executor (build the ToolNode from the same context-filtered set the model sees, or reject calls not in the current advertisement), add approval gates for state-changing tools especially for turns involving retrieved/untrusted content, and treat retrieved content as data, never instructions.