What happened
The agent harness lacks an interaction-boundary between untrusted channel content and privileged agent actions: a remote direct message is converted into an agent turn, and background sync places raw external content into the model context without neutralizing instructions or requiring approval for tool use. The demonstrated path creates persistent shell cron jobs via the agent, achieving unauthorized persistent command execution as the runtime user. The approval gate also reuses the JSON-RPC bearer token as an approval-session identifier, leaking it through persisted approval records and logs.
Why it matters
This is a novel agent-execution attack class: an autonomous agent, driven purely through an inbound message on a normal chat/email integration, can persist a shell job that executes later — bypassing the human-in-the-loop approval model that defenders rely on. It also shows how MCP/server metadata and background-synced content get silently spliced into agent context, which is the canonical indirect-prompt-injection route to agent tool misuse.
Attack vector
An attacker who can send messages to a configured external channel (email, Slack, Notion, Yuanbao) causes the agent to create persistent shell cron jobs without human approval; the scheduler later executes them as the OpenHuman runtime user. Command validation permits leading environment assignments that can redirect allowed commands to helper executables already on the host. Additional related paths let channel messages get default tool policy and let untrusted MCP-server metadata reach model context un-neutralized.
Affected systems
OpenHuman < 0.57.13 (cron/external-channel); < 0.57.5 (approval-token/env-token); < 0.57.13 (MCP metadata context injection); < 0.56.0 (Socket.IO, SSE, getDisplayMedia)
Mitigation
Upgrade to OpenHuman v0.57.13 (and v0.56.0 for the older transport issues). Review persisted approval records/logs for leaked bearer tokens and rotate the per-launch OPENHUMAN_CORE_TOKEN on macOS.