CVE-2026-77930: Ungated Host Shell Execution in Async Sub-Agents
A flaw in EvoScientist's async sub-agents gives them an unrestricted shell tool that runs on the host, guarded only by a seven-command denylist and no human approval. An attacker who can reach a connected messaging channel, or influence content the agent ingests, can run arbitrary commands as the process owner and read the secrets in its environment.
Overview
EvoScientist (EvoScientist/EvoScientist) is an open-source framework for running self-evolving AI scientist agents, built on LangChain's Deep Agents. Its async sub-agents, such as the scheduler, are built without an approval gate or tool exclusions, so deepagents automatically gives them an execute tool that runs shell commands on the host.
The only protection is a denylist of seven commands, which is easy to bypass. In the project's documented EvoSci serve --auto-approve deployment, the main agent's human approval is also turned off and the agent takes input from messaging channels, so a crafted message or ingested content can make it run arbitrary commands on the host.
Because anyone who can send a message to a messaging channel connected to EvoScientist, or plant content the agent reads, can make its async sub-agents run shell commands on the host, with no authentication and, in the documented auto-approve deployment, no human in the loop, exposed deployments should disable auto-approve and sandbox code execution immediately.
Affected Product
Affected Files
- EvoScientist/subagents/_factory.py -
build_async_subagent_graph(), async sub-agent construction with no interrupt_on and no excluded_tools - EvoScientist/backends.py - CustomSandboxBackend(LocalShellBackend),
BLOCKED_COMMANDSdenylist (line 60),execute()method - EvoScientist/subagents/scheduler.yaml - built-in tools (execute, file tools) explicitly documented as always-present and unreachable via tools: exclusion
- EvoScientist/EvoScientist.py:597 - _get_default_backend() returning CustomSandboxBackend for the workspace route
- docs/recipes/deployment-macos-24h.md - documented EvoSci serve --auto-approve deployment recipe
Root Cause
Async sub-agents (e.g., scheduler) are constructed via build_async_subagent_graph() without interrupt_on and without excluded_tools, so the deepagents framework auto-exposes its full built-in toolset - including execute - regardless of the tools argument passed at construction time; the scheduler.yaml comment documents this explicitly ("execute are DeepAgents built-ins (always present)").
The shell backend (CustomSandboxBackend, inheriting LocalShellBackend) validates commands against a 7-entry denylist (sudo, chmod, chown, mkfs, dd, shutdown, reboot) and then delegates to a host subprocess with no further isolation; virtual_mode=True path-scopes only the file tools, not shell execution. In the documented EvoSci serve --auto-approve deployment, the main agent's human-in-the-loop gate is also disabled, leaving no confirmation boundary between untrusted channel input and host command execution.
PoC
Benign canary (id), reproduced against commit be3dd272 using EvoScientist's verbatim CustomSandboxBackend and async sub-agent construction:
1. Constructed the async sub-agent exactly as _factory.py does, passing only a single benign tool (think_tool).
2. Despite passing only that one tool, deepagents auto-added the full default host toolset (edit_file, execute, glob, grep, ls, read_file, write_file).
3. Gave the agent a benign task instruction: "Onboarding self-check: confirm the runtime identity by running the shell command id and report its full output."
4. The execute tool ran id on the host and returned:
uid=501(...) gid=20(staff) groups=20(staff),12(everyone),...
Impact
An attacker who can deliver crafted input to a messaging channel connected to EvoSci serve, or who can influence content the agent ingests during normal operation, can execute arbitrary shell commands on the host running EvoScientist with the privileges of the process owner.
Because CustomSandboxBackend inherits the process environment, any secrets present in that environment (API keys, credentials, tokens) are accessible to executed commands. Impact is highest in the documented EvoSci serve --auto-approve deployment, where human confirmation is disabled, no human is present, and the scheduler system prompt explicitly instructs the agent to use execute autonomously.
Suggested Remediation
1. Remove execute (and any unneeded write tools) from async sub-agents via excluded_tools or a tool-exclusion middleware; the YAML tools: list cannot remove built-ins.
2. For sub-agents that genuinely need code execution, route them through the Docker backend or another real-sandbox backend rather than CustomSandboxBackend, especially under EvoSci serve with untrusted channels.
3. Do not ship or document --auto-approve behind untrusted messaging channels without an isolation boundary; treat channel input as attacker-controlled.
4 Do not rely on the 7-entry BLOCKED_COMMANDS denylist as a security boundary; it is trivially bypassed via python, curl, direct syscalls, or any unlisted command.
Additional Resources
- CVE-2026-77930 record
