Executive brief
Agent-S is an autonomous agent framework that can execute code locally. A vulnerability in its CodeAgent tool allows an attacker to craft a prompt that forces the system to execute a Python script with unbounded output, exhausting the worker process's memory and crashing the service. This results in a complete denial of service affecting all users of the shared CodeAgent worker.
Technical details
The vulnerability is a denial-of-service flaw in the CodeAgent component (code_agent.py) of Agent-S versions 0.3.1 and 0.3.2. The root cause is missing resource limits on Python subprocess execution: while bash execution has a 30-second timeout, Python execution has no timeout, CPU budget, memory budget, or stdout/stderr byte limit. An attacker can send a crafted low-trust task prompt that causes the LLM to generate a Python program with large bounded output (e.g., 900 iterations of 1 MB+ strings). The subprocess output is buffered entirely in memory before being returned to the agent, causing the worker process to exhaust available memory and be killed (OOMKilled). The attack is remotely exploitable through the CodeAgent integration endpoint. The vendor has not yet responded to the disclosure.
Affected products
- simular-ai Agent-S 0.3.1, 0.3.2
Timeline
- 2026-09-03: disclosed: CVE-2026-84885 published on NVD; exploit PoC disclosed publicly on GitHub
- 2026-09-03: other: Vendor contacted early but did not respond