OWL agent tool fetches any URL a prompt injection supplies

OWL's DocumentProcessingToolkit ships a tool, extract_document_content, that fetches whatever URL a caller supplies. It applies no scheme allowlist, no host filtering, and no block on internal IP ranges. A request aimed at an internal service goes through the same as one aimed at a public site.

Ordinary SSRF stops at the fetch. This one hands the body back to the agent, which reads it as context. The model uses that same material to decide what to do next. The flaw is tracked as CVE-2026-85675, published to the National Vulnerability Database on September 4.

A prompt injection buried in a document the agent is asked to process can supply a URL pointing at an internal service. Whatever that service returns becomes more input for the model to reason over, indistinguishable from the task it was given.

The advisory doesn't say whether OWL has released a fix or what a patched version restricts. Anyone running this toolkit against untrusted documents is exposed until that changes.