What happened
VulnCheck disclosed (2026-10-19) that Cognition before 0.13.0 defaults its agent sandbox backend to local execution and ships no authentication on its REST/SSE API. An unauthenticated attacker can create a session and post a message, causing the agent loop to run attacker-directed shell commands through the local shell backend. CVSS 9.8 (v3.1) / 9.2 (v4.0), CWE-306/CWE-1188.
Why it matters
This is a self-service unauthenticated RCE against an AI agent orchestration platform: an attacker who only has network reachability can execute arbitrary code on the box running customer agents, pivoting into the entire agent/LLM stack.
Attack vector
The REST/SSE API ships without authentication and the agent sandbox defaults to local execution. An unauthenticated POST /sessions (with a created session) followed by POST /sessions/{id}/messages drives the Deep Agents ReAct loop through the local shell backend, executing attacker-controlled shell commands as the server user (CWE-306 missing auth + CWE-1188 insecure default).
Affected systems
Cognition < 0.13.0 (pkg:github/CognicellAI/Cognition)
Mitigation
Upgrade to v0.13.0, which makes deployments fail closed for unsupported host/local execution and adds stricter tenant/scope enforcement.