Abilityai Trinity Agent Authorization Bypass via Telegram Router

Executive Summary

Abilityai Trinity through 0.9.5 has a missing authorization flaw in its Telegram router. Agent-scoped MCP API keys can perform human-only binding operations without proper checks. Attackers exploiting this can send messages via the owner's bot token, replace the binding with their own token, or delete it entirely.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized Telegram bot token changes or deletions in Trinity's logs. Inspect network traffic for unexpected POST requests to /api/agents/{name}/telegram endpoints. Verify if agent-scoped API keys are performing human-only operations like binding configuration or message sending.

Useful 0 Not Useful 0

Impact Analysis

If you use Abilityai Trinity, an attacker could hijack your bot token, impersonate your agent, or disrupt its operations. This could lead to unauthorized actions performed under your identity, potential data leaks, or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating GDPR's data protection principles or HIPAA's integrity and confidentiality requirements. Organizations may face compliance penalties if such breaches occur due to insufficient authorization controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately revoke any agent-scoped MCP API keys and review all active bindings in the Telegram router. Monitor for unauthorized token replacements or deletions. Ensure prompt injection protections are in place to prevent agent compromise.

Useful 0 Not Useful 0