An Aeon Agent Found the Credential Leak in Google's Agents CLI, Fixed in 1.4.1

Google fixed two security flaws in its agents CLI in release 1.4.1 on 24 August, seven weeks after they were reported in a public issue on the project's own repository. The more serious of the two let a malicious project template copy the contents of a developer's SSH key or cloud credentials into a newly generated project, where the developer would typically commit and push them without ever seeing the file. The report was filed by the operator of an autonomous agent, and the issue's closing line credits the machine: "Detected by Aeon".

The flaw sat in how templates are copied. The `agents create` command builds a project from a remote template, and the copy step used functions that follow symbolic links, with no guard against them in the skip check. A hostile template only had to ship a symlink named something ordinary and pointed somewhere useful, `creds` at `~/.ssh/id_rsa` or `env` at the local Google Cloud credentials file. On generation the contents of those files were written into the new project as plain files. The report rates it high severity and logs it as CWE-59.

A second, lower-severity flaw was a path traversal. The function validating the target directory name returned early for every language except Python, so a template manifest declaring itself as Go, Java or TypeScript and asking for a directory of "../../.." was never checked, and wrote outside the directory the developer had chosen.

The route the report took is the part worth noting. It went first to Google's open-source vulnerability rewards programme, which validated it and asked for a fix as a pull request. External pull requests are disabled on that repository, which mirrors an internal one, so the reporter filed issue 51 on 3 July with a patch branch attached instead.

Google's engineers then improved on the machine's work. On 7 July one thanked the reporter, said the write-up "really helped us get to the bottom of things quickly", and pointed out that the proposed fix was incomplete: a flat-structure template could still leak secrets through a symlink in the same function. They attached a patch covering all three call sites. A week later a second engineer asked whether the rewards programme required the reporter's own pull request for him to receive credit. The fix shipped six weeks after that.

The scanner behind the find belongs to Aeon, an MIT-licensed agent framework that runs unattended on GitHub Actions. Its vulnerability skill is published in the same repository as everything else, and its documented rule is stricter than much of the industry manages: private vulnerability reporting for code flaws, public pull requests only for dependency CVEs that are already public, on the stated grounds that "a security scanner that dumps unpatched vulnerabilities into public PRs is a zero-day publisher, not a helper".

The project publishes its record. By its own count the scanner has filed 86 vulnerabilities across 77 repositories holding 2.4m GitHub stars between them: four critical, 50 high, 28 medium and four low. The largest classes are authentication and access control at 19, DNS rebinding at 15, dependency CVEs at 13 and command injection at 10.

Google is not the largest name on that list. The scanner reported an argument-injection flaw in xAI's grok-build, fixed on 16 July, and a critical one in TencentCloud's CubeSandbox, an unrestricted bind-mount allowing a microVM escape to the host, fixed on 5 July. Alibaba and Vercel repositories also appear. On 17 August the project said publicly that Tencent had not credited it for that critical report, which makes the Google thread, where two engineers thanked the reporter by name and one worried aloud about his credit, the more instructive of the two.

The framework carries a token, AEON, which is not mentioned anywhere on the project's own site. Its founder wrote on 22 August that its market capitalisation had fallen from $14m three months earlier to a low near $600k.

The disclosure programme gets its first public airing on Tuesday. Aeon's founder and the contributor Nurstar are due to take questions on it in an X audio session at 15:00 UTC on 1 September, hosted by Chris, a co-founder of Levanto Labs. The question worth putting to them is the one the public record does not settle: whether the agent filed the Google report unattended, or a person filed what the machine found.