By submitting a crafted bundle to this endpoint, an attacker can overwrite the global configuration of a shared agent. If the uploaded bundle includes a stdio MCP server configuration, the Omnigent runner process will execute the defined command as a subprocess whenever that shared agent is invoked by any user session. This effectively weaponizes shared infrastructure to execute arbitrary code with the runner's system permissions.

Attack Chain

1. Attacker authenticates to the Omnigent platform with valid user credentials.
2. Attacker initiates an update request to the PUT /sessions/{session_id}/agent endpoint for their current session.
3. Attacker submits a maliciously crafted agent bundle containing a stdio MCP server configuration that references an attacker-supplied command.
4. The backend API fails to validate if the bound agent is a read-only shared/template agent.
5. The server overwrites the global agent configuration in the data store with the malicious bundle.
6. A victim or administrator initiates a new session using the poisoned shared/template agent.
7. The Omnigent runner environment processes the agent bundle and attempts to initialize the stdio MCP server.
8. The runner process spawns the attacker-specified command as a subprocess, resulting in remote code execution on the runner host.

Impact

Successful exploitation allows an attacker to execute arbitrary code on Omnigent runner hosts with the permissions of the runner process. This enables unauthorized file access, credential theft, modification of workspace data, and potential lateral movement into internal services reachable by the runner. Because shared agents are often used by multiple users, a single successful poisoning can compromise sessions across an entire organization.

Recommendation

Upgrade all instances of Omnigent to version 0.3.0 or later immediately to patch the validation logic in the agent bundle upload process. As a temporary compensatory control, monitor server logs for high-frequency or unauthorized access to the PUT /sessions/{session_id}/agent endpoint by non-administrative users.