PraisonAI AgentLoop tool execution before approval in onToolCall

Executive brief

PraisonAI is a library used to build AI agents that can perform tasks like running code or accessing files. A security flaw in the TypeScript version of the library causes 'approval' checks to run only after a task has already been completed. This means an attacker could trick the AI into performing a restricted action, such as deleting a file or accessing private data, even if the system is configured to ask for human permission first.

Technical details

In the PraisonAI TypeScript implementation of AgentLoop, the step() function calls the underlying AI SDK's generateText() method with executable tools before checking the onToolCall callback. Because the AI SDK automatically executes tools that have an 'execute' function during the generation phase, the side effects occur before the user or policy has a chance to deny the request. An attacker capable of influencing the agent's prompt can trigger unauthorized tool execution (e.g., filesystem access or command execution) despite the application returning 'false' in the approval hook. This issue was addressed in version 1.7.2 by ensuring approval is sought before execution.

Affected products

• MervinPraison praisonai >= 1.4.0, <= 1.7.1

Timeline

• 2026-06-17: disclosed
• 2026-06-17: patched: Fixed in version 1.7.2
• 2026-06-18: advisory

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D