| عنوان | Simular AI Agent-S 0.3.2 Denial of Service |
|---|
| الوصف | Agent-S contains a denial of service vulnerability in its model-generated GUI action execution workflow. The S3 worker accepts model-generated agent actions, validates only that the action is syntactically valid, converts it to executable code, and returns it for execution without enforcing resource boundaries on action parameters. Parameters such as wait duration, scroll count, hotkey list length, and typed text length are not capped.
A crafted task prompt can cause the model to generate an action such as agent.wait(3600), which is accepted and converted into time.sleep(3600). In a deployed agent service, a single malicious or malformed prompt can monopolize an agent execution worker for an attacker-controlled duration, causing legitimate tasks to remain pending or time out. |
|---|
| المصدر | ⚠️ https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report |
|---|
| المستخدم | outlookgp (UID 99658) |
|---|
| ارسال | 11/07/2026 02:43 PM (2 أشهر منذ) |
|---|
| الاعتدال | 02/09/2026 04:16 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 398136 [simular-ai Agent-S حتى 0.3.2 Model-generated GUI Action Execution Workflow grounding.py الحرمان من الخدمة] |
|---|
| النقاط | 20 |
|---|