Omnigent, an open-source meta-harness that runs coding agents behind a single policy and sandbox layer, received four security advisories in one burst on 2 September. They include a critical authenticated remote code execution issue on runner hosts and two further high-severity flaws. The one worth reading in full is rated lowest of the four.
The abstain-means-allow bug
CVE-2026-62676 describes a shared shell-command parser that backs two separate controls: the repository and branch allowlist, and the working-directory confinement. When a gated command arrives in a form the parser does not model, it yields no operation, the evaluator returns nothing, and nothing is treated as abstain, which resolves to allow. The advisory lists the bypasses: wrapping the command in bash -lc, prefixing it with wrapper binaries such as timeout or nice, or hiding it inside command substitution. The classification is CWE-184, incomplete denylist, and it sits on the component whose entire job is to say no.
What the common framing gets wrong
Two things. First, severity ranking inverts the operational story: the 7.1 is more consequential than the 9.0 for anyone running this harness as a containment layer, because it defeats the product's core promise — run untrusted model output, but confined — rather than requiring existing authenticated access. Second, and more important for readers scanning CVE feeds: these are not new bugs. The fix commits landed on 26 and 27 June, with the patched release following immediately. The advisories are dated 2 September. That is a 68-day gap between the code being fixed and the users being told.
Why the gap is the recurring lesson
Anyone tracking AI tooling risk through CVE publication dates is reading a signal that lags the actual exposure window by weeks to months. In this ecosystem, the release notes are the security feed. Teams pinning agent-harness versions should be watching repository releases, not waiting for advisories to appear.
The design rule it produces
The remediation the advisory recommends reads as a checklist for anyone building a tool-approval layer: abstain must resolve to deny, wrapper binaries must be canonicalised, and the evaluator must recurse into sh -c and command substitutions before judging. Home-grown approval layers built this year are shipping the same shape of bug right now.