# Unverified inbound message triggers agent

Inbound mail, webhook, or bot event resumes a privileged agent session without verifying sender or signature

_Area: AI and LLM app security. Seen in 3 disclosed reports; latest 2026-10-07. Updated 2026-10-25._

## How it works
An agent session is a privileged sink: it can call tools, read files, and act with the operator's credentials. The code that wakes or resumes that session trusts the *shape* of the inbound event rather than its *origin*. A sender string, an actor suffix, or a body field is treated as proof of identity, so anyone who can produce a matching string can drive the agent. The broken assumption is that "the message arrived through our channel" means "the message came from someone we trust."

## Where it shows up
- Authz checks that compare an actor string suffix (e.g. ends with `[bot]`) or an App display name, with no check that the App is installed on the repo [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md).
- A privileged resume/dispatch path that skips the sender gate its sibling handlers apply (operator-reply check, operator chat ID) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md).
- Webhook handlers that call `request.json()` and branch on a caller-controlled `type` field before reading the raw body or verifying signature headers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md).
- A signing secret returned at registration time that is never persisted or used [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md).
- Untrusted message fields (from/subject/preview, PR/issue text) interpolated into prompts fed to a fully-privileged agent [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md).

## How to review
For every path that wakes, resumes, or dispatches an agent, find the exact gate and confirm it verifies origin, not format. The invariant: **no privileged agent action runs unless the inbound event's authenticity is established against a secret or an installation record the attacker cannot forge.** Concretely: does the handler verify a signature over the raw body before parsing? Is the webhook secret stored and used? Does the actor check confirm the App is installed on this repo, not just that the name matches? Does this path apply the same sender gate as its sibling handlers? Diff privileged sinks against each other; a gate present on one path and missing on another is the signal [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md).

## Variants seen
- Name/suffix-based trust of bot actors, enabling a registered or spoofed App to trigger AI execution [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md).
- Missing operator-sender check on an inbound-mail bridge that resumes a session with bypassPermissions [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md).
- Unsigned webhook accepted because the handler dispatches on a body field before signature verification [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md).

## Why fixes fail
Gating one path while leaving a sibling privileged path ungated leaves the same sink reachable [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md). Storing a webhook secret but not verifying against the raw body still accepts forged events [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md).

## Impact and severity
Unauthenticated remote invocation of a privileged agent: exfiltration of dynamically-created cloud credential files [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md), full-permission session hijack via injected mail fields [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md), forged agent dispatch [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md). Severity rises with the agent's tool access and with prompt injection of attacker-controlled content.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-fq4x-789w-jg5h.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-7c92-x8vg-4258.md