SECURITY: Fix multiple engine bypasses (empty strings, missing timestamps, negative cost) - #4
Open
iQodeIT wants to merge 2 commits into
Open
SECURITY: Fix multiple engine bypasses (empty strings, missing timestamps, negative cost)#4iQodeIT wants to merge 2 commits into
iQodeIT wants to merge 2 commits into
Conversation
kindrat86
pushed a commit
that referenced
this pull request
Aug 12, 2026
…LinWang312 #1) Fixes 2 bugs reported by @LinWang312 on issue #1: Bug #3 (DoS): _fmt() crashes on Decimal.quantize() when amount has >28 significant digits (e.g. 1e50, 1e27). Wrapped in try/except InvalidOperation, falls back to scientific notation instead of crashing the pipeline. Bug #5 (False Positive): 'if agent_id and ...' treats None as falsy, skipping the agent filter when current txn has no agent_id. This causes unrelated agents' priors to be counted in velocity, daily_total, and session_budget. Fixed: 'if prior.get("agent_id") != agent_id: continue' treats None != "agent_a" correctly. Note: Bugs #1 (already fixed), #2 (defensible design), #4 (correct behavior) were not bugs per source code review. Eval gym: 69/69 passed (4 new scenarios: #66-69)
iQodeIT
force-pushed
the
fix/security-bypasses
branch
from
August 24, 2026 15:03
03297d5 to
72cdff9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses multiple security bypasses identified in the AgentShield rules engine as part of the $1,000 security challenge.
Vulnerabilities Fixed
Nonevalues were incorrectly handled, allowing transactions to bypass enforcement.timestampfield bypassed velocity and budget checks. Now defaults tonow()if missing.session_budgetrule did not validate thatamountwas positive, allowing "negative cost" transactions to artificially increase a user's remaining budget.amountfield to prevent silent failures.Verification
tests/bounty_tests.pycovering all identified bypass vectors.