A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-108819 represents a critical code injection vulnerability in the Agno-AGI framework's Agent Orchestration Layer that allows remote attackers to manipulate the `exec` function's code argument, resulting in arbitrary code execution through dynamically-managed code resources. This vulnerability affects versions up to 3.0.6 and 3.1.1, impacting organizations deploying Agno for AI agent orchestration and automation tasks. The threat is particularly severe because exploitation is possible remotely without requiring authentication, and proof-of-concept exploits are publicly available, creating immediate risk for unpatched systems. Any organization using Agno-AGI for agent-based workflows should consider this a priority patch candidate.
While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's 754 security skills—powered by Claude AI's extended reasoning capabilities—can detect attack patterns associated with code injection and dynamic code execution. Practitioners using Casky would observe detection signals around CWE-913 (Improper Control of Dynamically-Managed Code Resources), including suspicious argument manipulation attempts to the Agent Orchestration Layer's exec function, unusual subprocess spawning from agent processes, and anomalous code resource instantiation patterns. Security teams should monitor for reconnaissance activity probing the Agno framework version, POST requests with encoded payloads targeting orchestration endpoints, and execution indicators such as unexpected process trees or system calls originating from agent execution contexts. Early detection requires baseline understanding of normal agent orchestration patterns to identify deviation.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-108819. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation