What happened
An authentication boundary failure in the OpenBMB Internet of Agents Agent Registry: an unauthenticated remote attacker can call the register function and pass manipulated desc/name values, due to missing authentication. Exploit details are public.
Why it matters
The Agent Registry is the namespace an IoA deployment uses to discover and co-ordinate agents; an unauthenticated actor able to register or tamper with registry entries can inject untrusted agents or disrupt agent orchestration.
Attack vector
Unauthenticated remote call to the register() function in im_server/app.py of the Agent Registry (CWE-306 missing authentication).
Affected systems
OpenBMB Internet of Agents (rolling release, up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a); no versioned fix released
Mitigation
No official fix published — the maintainers have not responded. Restrict network exposure of the registry and monitor for unauthorized agent registrations.