Description

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T11:17:11.030Z",
  "pubdate": "2026-09-15T11:17:11.030Z",
  "executiveSummary": "PraisonAI versions 1.4.0 through 1.7.2 contain a critical vulnerability involving the improper sequencing of tool execution and security policy enforcement. The flaw resides within the createAgentLoop() function, which erroneously triggers tool execution via the underlying AI SDK generation process before the onToolCall approval callback is evaluated.\nThis vulnerability effectively bypasses intended security boundaries, as the AI SDK processes tool requests and performs side effects—such as file system operations, command execution, or external API requests—immediately upon generation. Because the application logic only records the 'tool_rejected' status after the callback returns false, the damage is already realized before the refusal is logged.\nAn attacker capable of influencing the AI model's output can force the execution of arbitrary tools, bypassing human-in-the-loop or programmatic policy approvals. This results in unauthorized data exfiltration, system modification, or command execution depending on the toolset configured. The vulnerability poses a significant risk to the integrity and confidentiality of the environment hosting the PraisonAI agents. Immediate upgrading to version 1.7.2 or later is required to ensure that tool execution is gated by the verification callback.",
  "technicalDetails": "The root cause of this vulnerability lies in the architectural misuse of the AI SDK generation pipeline within the src/praisonai-ts/src/ai/agent-loop.ts file. In the affected versions, the createAgentLoop() function initiates the generateText() process in a manner that allows the underlying SDK to automatically interpret and execute tool-calling sequences present in the generated model output.\nIn a secure implementation, the tool execution handler should be deferred until the application logic has explicitly validated the requested tool and arguments via the onToolCall callback. However, PraisonAI's implementation delegates the handling of tool calls to the wrapped AI SDK during the generation phase itself. As a result, the SDK interprets the model's output and invokes the tool handlers (e.g., executing shell commands or writing to files) before the application code has an opportunity to perform a policy-based rejection.\nThe attack flow follows a predictable pattern: 1) The attacker provides malicious input to the PraisonAI agent. 2) The model generates a response containing an unauthorized tool call (e.g., a file system deletion command). 3) The AI SDK processes this output and immediately invokes the registered tool handler, executing the command in the environment. 4) Only after the tool has completed its operation does the PraisonAI loop trigger the onToolCall callback. 5) If the callback returns false, the system logs 'tool_rejected', which serves as a post-facto notification of a security failure that has already occurred.\nThis creates a race condition between the security policy enforcement and the execution engine, where the execution engine consistently wins. Because the tool execution occurs synchronously within the generation flow, the onToolCall mechanism is relegated to a simple logging utility rather than a functional security gate. There is no requirement for additional authentication or privilege escalation by the attacker; they only need to successfully induce the AI to generate a tool-calling structure. The post-exploitation impact includes full command injection, persistent unauthorized data modification, or interaction with sensitive internal APIs, as the tools operate with the privileges of the PraisonAI process."
}