A critical vulnerability in MaxKB, identified as CVE-2026-77521, enables attackers to trigger arbitrary shell commands via prompt injection through AI assistants configured with tools, MCP integrations, skills, or sub-applications This article explores vulnerability maxkb. . Researchers at Lasso Security reported that an attacker can exploit an exposed agent execution path to run commands on the underlying host or, in containerized deployments, potentially execute commands as root.
MaxKB's AI Agent Flaw MaxKB routes conversations through a deepagents agent whenever an assistant has a connected tool, MCP server, skill, or sub-application. MaxKB outlines approval behavior for file-related operations such as write_file, read_file, and edit_file, but does not implement human-in-the-loop controls for the execute capability.
Consequently, untrusted prompts submitted through a chat interface or malicious instructions embedded in documents processed through retrieval-augmented generation workflows can influence the underlying model to execute operating-system commands. This vulnerability is particularly concerning for public or embedded assistants that accept anonymous input, as well as multi-tenant deployments where one user’s content can impact an agent handling sensitive data or internal services. Successful exploitation could lead to access to secrets and configuration files, probing internal services, lateral movement, persistence, or affecting other tenants sharing the same environment.
Baixin demonstrated that a benign, system-administration-style request was sufficient to trigger the agent to invoke system information commands and write host-derived output to a file.
