AI Agent Security: The Approval Bugs Disclosed In October And Six Questions To Ask Your Vendor

AI agent security is mostly about one thing: making sure an agent can only do what a person allowed, for the request the person saw. In the four weeks to mid-October 2026, three open-source agent tools published fixes for exactly that kind of weakness. None of this means agents are unsafe to use. It means the place where approvals are checked matters, and a buyer should ask about it.

What AI agent security bugs were disclosed?

• **Approvals trusted from the browser.** Pydantic AI's advisory CVE-2026-107295, published on 8 October 2026 with a CVSS score of 7.6, said tools marked as needing approval “were not protected either, because the endpoint trusts approval decisions relayed by the client”.
• **Approvals reused for a different request.** The praisonaiagents advisory CVE-2026-60087, also published on 8 October, described a human approval remembered by tool name only, so a later request with different details could run without review.
• **Hidden tools that could still be called.** CVE-2026-77243 in mcp-atlassian, published on 22 September 2026, described a server that limited the tools it listed but still ran tools from its full set when asked by name.

Each project has released a fix. On 15 October 2026 the OpenAI Agents SDK said in its release notes that it treats tool descriptions from MCP servers as untrusted hints that do not grant approval. CSO Online summed up the mood on 14 October with the headline “AI agents aren't going rogue, frontier labs are skipping security basics”.

Why does AI agent security matter for financial firms?

Because the actions that need approval in a financial firm are the ones that move money, change client details or reach clients. A payment file, a change to settlement instructions or an email to a client should never go ahead because an approval for something else was reused. The bugs above are exactly the routes by which that could happen.

What six questions should you ask an AI agent vendor?

• **Where is an approval stored?** It should be on the vendor's or your server, never decided by the browser.
• **What is an approval tied to?** It should cover one agent, one action and the exact details the person saw.
• **Can an approval be used twice?** It should work once and expire.
• **Are limits checked on every action?** Not only when the agent is shown its list of tools.
• **Who approved, and when?** Every approval should name a person from your own sign-in system.
• **Can we see the log?** Every action, approval and refusal should be recorded where it cannot be quietly edited.

What does good AI agent security look like?

Our Agentic AI London team builds approvals as records on the server, tied to the exact action and used once, with limits checked every time the agent tries to do something and every step written to an audit log. Technical readers can see the design in code in our playbook on AI agent code in Python, and our earlier article on AI agents for financial firms covers the incidents that raised these questions.

Where should a firm start?

Send the six questions to every vendor whose product includes an AI agent, and keep the answers. If you are building your own, our services page shows how approval points are designed into each workflow, and the 14-day Proof Run puts one agent on your process with the approval step and audit trail in place from day one.