AIKIDO-2025-10949

TL;DR

Affected versions of this package are vulnerable to sensitive information disclosure due to a missing filtering step for state messages, specifically within the agent_history_description. It allows sensitive values (like passwords and API keys) from action results to be included in messages sent to the LLM, as the system failed to replace these actual values with placeholder tags before transmission. An attacker could exploit this by crafting malicious actions or prompts that cause the agent to execute operations returning sensitive data, which would then be leaked into the LLM's context in subsequent messages, potentially enabling the extraction of credentials, secrets, or other protected information through the chat history.