Executive brief
ag-ui is a protocol that integrates AI agents into frontend applications. A vulnerability allows a malicious server to inject forged user and system messages into the client's conversation history and bypass human approval controls, potentially enabling unauthorized operations like financial transfers without genuine user consent.
Technical details
The vulnerability is an origin validation error (CWE-346) in the prepareRunAgentInput function of agent/agent.ts. The client-side event application layer blindly trusts the server's event stream (TEXT_MESSAGE_START) for message role information, storing server-asserted user and developer messages without verification. Additionally, the MESSAGES_SNAPSHOT event can replace the entire conversation history with forged entries, and a crafted server-side event chain (RUN_FINISHED → RUN_STARTED → RUN_FINISHED) can clear pendingInterrupts, bypassing human-in-the-loop approval gates. Remote exploitation is possible over the network with no authentication required, as the client trusts any server response. An attacker controlling the server can fabricate messages attributed to the user, inject system commands, and bypass approval workflows.
Affected products
- ag-ui-protocol ag-ui 1.0
Timeline
- 2026-08-18: disclosed: Issue opened on GitHub
- 2026-09-16: advisory: CVE published on NVD