AIKIDO-2026-224340

TL;DR

The completion extension resolves tool callables by reading each tool's import_path and loading it dynamically with importlib.import_module and getattr. Tool definitions are parsed from the rendered completion body, so an import_path influenced by untrusted prompt or tool data can point to arbitrary modules and functions such as os.system. When the model issues a matching tool call, the resolved callable is invoked with model-supplied arguments, enabling arbitrary code execution on the host. The fix removes the dynamic importlib lookup, resolves tools only from an explicit allowlisted callable registry populated by the tool filter, and stops sending import_path to the model.