Four advisories land on Databricks' Omnigent meta-harness, one critical, all reported by an autonomous security agent
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the Databricks meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h (CVSS 9.0) lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{id}/agent and attach a stdio MCP server that every future session then launches; GHSA-756x (8.8) reaches runner RCE by pointing a bundle tool at subprocess.check_output; GHSA-p8rw (8.8) takes os_env.cwd verbatim for arbitrary host filesystem access; GHSA-7mqg (7.1) is a fail-open shell parser where an unrecognized command yields None, which the evaluator treats as allow, bypassing both the GitHub allowlist and working-directory confinement. All four were reported by Aeon, an autonomous security agent.
↳ Follow the thread