External risk intelligence

Omnigent Agent Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-62674

Omnigent is an AI agent framework and orchestrator designed for development environments. It exposes web-based API endpoints for session management and agent interaction, which are commonly deployed as network-accessible services to facilitate collaborative coding or remote agent orchestration.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Omnigent AI agent framework. An authenticated user with edit access could potentially exploit this to execute commands with the Omnigent runner's permissions, potentially exposing sensitive data and internal services. The main concern is confirming relevance and exposure to this framework.

Attackers could run unauthorized commands.
Affects AI agent orchestration and sensitive data.
Confirm if your AI agent framework is affected.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated edit access to a session can manipulate a shared agent bundle to inject a command. This command, when later executed by other sessions using the compromised agent, runs with the Omnigent runner's permissions, potentially leading to the exposure of sensitive data and system compromise.

Authenticated user with edit access.
Replace shared agent bundle with malicious code.
Compromise runner, expose sensitive data.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with edit access to an Omnigent session could exploit this vulnerability to replace a shared agent bundle. This malicious replacement, when used by later sessions, could lead to the execution of an attacker-controlled command with the permissions of the Omnigent runner process. This could potentially expose sensitive information and compromise the availability of the runner.

System data and internal services.
Replace shared agent with malicious code.
Execute arbitrary commands.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in the Omnigent AI agent framework. The first practical step is to identify all deployments of Omnigent, confirm their reachability and business criticality, and then determine the accountable owner for remediation planning.

Application and platform teams own the issue.
Verify session agent configurations and reachability.
Plan coordinated upgrade or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Omnigent?

Omnigent is an open-source framework used to orchestrate AI-driven coding agents. It provides a meta-harness for managing development sessions, allowing teams to coordinate automated tasks and share agent configurations across different coding environments.

How does CVE-2026-62674 work?

This vulnerability is a form of code injection (CWE-94). It occurs because the software fails to properly restrict the modification of shared agents. If a user can update a session's agent configuration, they can attach a malicious command that runs whenever that agent is later utilized by other sessions.

Does any session configuration prevent this bug?

The flaw specifically involves shared or template agents that lack a defined session ID. Sessions that exclusively use private, isolated agents with unique session IDs are not susceptible to this specific method of command injection.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal notes that Omnigent is often deployed as a network-accessible service to support collaborative coding. If your instance is reachable over the network, it is classified as external, increasing the importance of reviewing access controls.

What should I do to secure my Omnigent installation?

Your first step is to identify all running instances of the framework within your environment. Once mapped, prioritize upgrading to version 0.3.0 or later, which contains the fix to correctly validate agent permissions and prevent unauthorized command injection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.