The scope of the impact includes owner-only capabilities such as financial wallet transfers, arbitrary memory writes, and unauthorized agent calls. By providing the exact tool name and associated arguments - potentially via indirect prompt injection or by replaying previously captured session history data - an actor can force the execution of restricted tools without requiring human-in-the-loop approval. This bypasses the intended security boundary of the framework, posing a high risk to data integrity and financial assets managed by the agent.

Impact

Successful exploitation allows for unauthorized execution of sensitive agent functions. In environments where IntentKit manages financial accounts or persistent memory, this can lead to unauthorized asset transfers or data manipulation. The vulnerability is exploitable by public callers, meaning any integrated interface exposing the IntentKit executor is at risk.

Recommendation

• Upgrade IntentKit to a version beyond 2.6.3 as soon as a patch is available.
• Audit application logs for calls to privileged state-changing tools (such as wallet transfer or memory-write) originating from public or untrusted contexts that do not coincide with expected user session checkpoints.
• Implement stricter server-side validation of tool call arguments to ensure they conform to the intended scope defined by ToolBindingMiddleware, rather than relying solely on the framework's internal registry validation.