AIKIDO-2026-302061

TL;DR

The http_request tool validates only the target URL against the configured credential allowlist and does not validate the proxy destination. When untrusted content processed by the agent triggers indirect prompt injection, the model can be steered to route a request through an attacker-specified proxy in the same tool call. Because the allowlist check ignores the proxy endpoint, the Authorization header bound to an approved host is sent through the attacker's proxy, and GET requests bypass the consent mechanism. The fix validates proxy destinations against the credential allowlist so bound credentials cannot be exfiltrated to unapproved destinations.