Executive brief
CowAgent is an AI agent framework that includes a built-in Bash tool for executing shell commands. A denial-of-service vulnerability exists where an attacker can inject prompts that cause the Bash tool to execute commands with extremely large output, exhausting memory and rendering the agent process unavailable. This impacts availability of systems running CowAgent, particularly those accepting untrusted user input.
Technical details
The vulnerability is a denial-of-service flaw in the Bash tool component (agent/tools/bash/bash.py) where command output is fully buffered in memory before truncation is applied. An attacker can perform prompt injection to cause the agent to invoke the Bash tool with a command that emits very large stdout or stderr output. The tool accumulates all output chunks in byte buffers, decodes the full output, and writes it to a temporary file without size limits, leading to memory exhaustion and process unavailability. The attack is remotely exploitable via crafted task instructions and does not require authentication. Vendor contact was attempted early in disclosure but was unanswered.
Affected products
- zhayujie CowAgent up to 2.1.7
Timeline
- 2026-09-02: disclosed