IntentKit through 2.6.3 lets public callers run owner-only tools, including wallet transfers

Summary

IntentKit, an open-source framework for autonomous AI agents with built-in crypto wallet and DeFi tools, contains an authorization bypass (CVE-2026-76066, CVSS 3.1 7.5 High). The executor validates tool calls against the full tool registry rather than the per-request narrowed tool list enforced by ToolBindingMiddleware. As a result, owner-only state-changing tools remain callable in public contexts.

Affected

• crestalnetwork/intentkit (PyPI: intentkit) through 2.6.3
• No fix available at time of publication (2.6.3 is the latest PyPI release as of this advisory)

Impact

An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can supply the exact de-advertised tool name and arguments, via indirect prompt injection in content the agent fetches or by replaying checkpoint and history data on a reused thread. This lets them run owner-restricted tools such as wallet transfer (cdp_native_transfer), DeFi swaps, posting, memory-write, and call-agent without any human-in-the-loop or approval gate. Lasso Security lists no known exploitation.

Recommended actions

• Do not expose IntentKit agents with funded wallets to public users or untrusted content until a fix is released.
• Enforce tool availability at the executor: build the ToolNode from the same context-filtered tool set the model is shown, or reject tool calls not in the current turn's advertisement.
• Add an approval gate for state-changing tools (wallet transfers, DeFi, posting), on by default for public or shared agents.
• Treat retrieved and inbound-message content as data, and ignore tool directives that come from it.

Source & attribution

This 0xCERT advisory summarises a disclosure by VulnCheck (CNA) and Lasso Security: https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode and https://www.lasso.security/vulnerability-database/cve-2026-76066. Details may change; refer to the original source for the authoritative record.