| 제목 | Simular AI Agent-S 0.3.2 Denial of Service |
|---|
| 설명 | Agent-S contains a denial of service vulnerability in its model-generated GUI action execution workflow. The S3 worker accepts model-generated agent actions, validates only that the action is syntactically valid, converts it to executable code, and returns it for execution without enforcing resource boundaries on action parameters. Parameters such as wait duration, scroll count, hotkey list length, and typed text length are not capped.
A crafted task prompt can cause the model to generate an action such as agent.wait(3600), which is accepted and converted into time.sleep(3600). In a deployed agent service, a single malicious or malformed prompt can monopolize an agent execution worker for an attacker-controlled duration, causing legitimate tasks to remain pending or time out. |
|---|
| 원천 | ⚠️ https://github.com/outlookgp/CVE/tree/main/AgentS_Action_Parameter_Budget_DoS_Report |
|---|
| 사용자 | outlookgp (UID 99658) |
|---|
| 제출 | 2026. 07. 11. PM 02:43 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 02. PM 04:16 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 398136 [simular-ai Agent-S 까지 0.3.2 Model-generated GUI Action Execution Workflow grounding.py 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|