$ the-wire · showcase
Agent hypervisor closes sudo, doas and xargs bypass
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
2 people shipped this
Two denial paths in microsoft/agent-governance-toolkit were leaking: wrapper prefixes hid the command the policy was supposed to check, and non-DID principals could still reach MCP tool calls.
fix(agent-hypervisor): check the command behind sudo, doas and xargs microsoft/agent-governance-toolkit
RingEnforcer.check_command unwraps env, nohup and timeout but treated sudo, doas and xargs as the executable itself, so a denied command running behind them was allowed. Per the PR, the wrapper table now covers them with option tables, which closes the bypass for forms like sudo -u root curl and xargs -n1 curl.
fix(dotnet): deny MCP calls from authenticated principals whose identifier is not a DID (#4362) microsoft/agent-governance-toolkit
McpGovernanceRuntime no longer accepts an authenticated principal's agent_id, NameIdentifier or Name claim as the agent ID without checking it. An OIDC subject such as a GUID or an email address used to reach AgentIdentity.NormalizeDid and throw ArgumentException inside GovernanceKernel.EvaluateToolCall; those calls are now denied before evaluation.
Action items
- → Update microsoft/agent-governance-toolkit to a build containing the wrapper table fix before relying on sudo, doas or... microsoft/agent-governance-toolkit [plan]
