Executive brief
Agent-S is an AI-powered automation tool that generates and executes GUI actions based on model output. An attacker can craft prompts that cause the model to generate actions with unbounded parameters (such as extremely long wait times), causing the agent worker to hang indefinitely and become unavailable for legitimate tasks. This could disrupt service availability in any deployment using Agent-S for automated workflows.
Technical details
The vulnerability is a denial-of-service flaw in the model-generated GUI action execution workflow (grounding.py and related modules). Agent-S accepts model-generated action strings, validates only syntactic correctness, then converts and executes them using eval() and exec() without enforcing resource boundaries on action parameters. An attacker can supply a crafted task prompt that causes the local model to return actions like agent.wait(3600) with arbitrary durations. The vulnerable code directly embeds these unsanitized parameters into executable code (e.g., time.sleep(3600)), causing the worker process to block for attacker-controlled durations. No per-action runtime budget or parameter validation exists before execution, allowing a single malicious prompt to monopolize the worker and cause subsequent legitimate tasks to time out or remain pending. The vendor was contacted early but did not respond.
Affected products
- simular-ai Agent-S up to 0.3.2
Timeline
- 2026-09-03: disclosed
- other: Exploit code publicly available on GitHub