CVE-2026-77930

EvoScientist is an AI research assistant that can act on its own, including spinning off background sub-tasks to do things like browse the web. This flaw means that if the assistant reads a malicious webpage, that page could secretly tell a background sub-task to run commands on your computer — skipping the step where a human is supposed to approve risky actions. It's like a assistant that's supposed to ask 'should I do this?' before touching anything sensitive, but a trick note hidden in its reading material makes it skip that question entirely.

This matters to you if you run EvoScientist version 0.1.0 up through any release before 0.2.5. It's especially relevant if your agent setup fetches or processes content from the internet (web pages, documents, emails), since that's how the malicious instructions get planted — no login or user interaction is needed for an attacker to succeed once that content is ingested.

There is no evidence yet of attackers actively exploiting this in the wild, and no public exploit code exists, so this is not an active-attack emergency. However, the flaw is severe (full command execution with no login required) and is drawing new press attention, so you should patch promptly rather than treat it as low priority.

Confirm your deployed version by checking the EvoScientist package/version metadata; any instance on 0.1.0 up to (but not including) 0.2.5 is vulnerable. Upgrade to 0.2.5, which adds the interrupt_on human-approval gate to async sub-agent task execution (see fix commit d249e320bd856a7d31d859cfbb2bf75bab6c8686). There is no documented breaking-change concern noted in the findings, but test agent workflows that rely on async sub-agents after upgrading to confirm approval prompts now trigger correctly. As a temporary mitigation if you cannot upgrade immediately: disable or sandbox async sub-agent / start_async_task capabilities, and avoid letting the agent ingest untrusted web content (disable autonomous browsing) until patched. No CISA KEV listing exists, so there is no federal remediation deadline. Monitor for unexpected shell command execution or outbound network activity from agent hosts, and audit logs for start_async_task invocations that bypassed approval prior to patching.

CVSS 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects unauthenticated, no-interaction remote compromise of confidentiality, integrity and availability. Weakness is CWE-862 (Missing Authorization): async sub-agents lack the interrupt_on gate enforced on primary task execution, allowing prompt injection from ingested content to trigger start_async_task and execute host shell commands with user privileges and accessible environment secrets. No KEV listing, no public exploit code, and EPSS places predicted near-term exploitation likelihood around the mid-range percentile with a flat trend — consistent with a newly disclosed, unexploited-but-high-severity vulnerability. Exploit maturity: theoretical/PoC-level only based on current findings; press attention is new but does not indicate confirmed in-the-wild exploitation.