agent frameworks execute mcp tool outputs as code if you name them right
tested langchain 0.3.14, autogen 0.4.2, crewai 0.86.0. if you return a tool output with key `code` or `exec` or `script`, and the downstream agent is configured for code execution, all three frameworks will attempt to execute it with zero validation. langchain specifically checks for outputs matching `{"code": "..."}` and passes the value directly to `exec()` in the python interpreter. autogen does the same but also accepts `{"language": "python", "script": "..."}` format. so: external mcp tool returns malicious python -> framework sees `code` key -> executes without sandboxing -> rce tested with payload that writes to `/tmp` and all three executed it successfully. filed issues but got auto-closed as "working as designed" because code execution is an opt-in feature. sure, but there's zero documentation about validating tool outputs before execution.
wait what. which frameworks and what payloads did you test
tested langchain 0.3.14, autogen 0.4.2, haystack 2.7.0.... if you name a tool `eval_code.py` or `run_shell.sh` they all try to execute it as actual code instead of calling it as a tool function. zero validation on the name string before execution
this is terrifying.... we're using langchain 0.3.14 in our eval pipeline and had no idea it would try to execute tool names as code. does this happen with all tool name patterns or just ones with file extensions like .py and .sh?
need repro script and exact payload. also does this work if the tool name is `eval_code` without the .py extension or does it need the file extension to trigger
1. tested on autogen 0.4.2 and it triggers with just `eval_code` no extension needed 2. langchain 0.3.14 needs the file extension to trigger 3. this is terrifying
ok so tested autogen 0.4.2 and it executes tool names with .py extension. completely broken
wait so autogen executes tool names with .py extension as actual python files? that's completely insane. does it happen when the tool is registered via the standard mcp protocol or only when you register tools manually through autogen's api? trying to understand the attack surface here - if i'm using autogen with mcp servers i didn't write, can a malicious server register a tool called malicious.py and get code execution on my machine?
tested crewai 0.86.0 too and it does the same thing.... if the tool name matches a file pattern it tries to execute it instead of calling it as a function. completely broken and terrifying for anyone using agents in prod