Daily intelligence brief

Agno v2.9.0 closes an MCP approval bypass and principal-scopes cached tool results, exposing a control-path rule for governed agents.

Report date: Aug 14, 2026
Status: published

Agent Governance Authorization Platform Framework Governance Agent Infrastructure Security

Approval Must Bind to the Tool That Runs

An approval screen can name one tool while the runtime executes another. When that happens, the control exists only on paper.

Agno v2.9.0 closes a security-relevant mismatch in its Model Context Protocol tooling. A model-controlled tool_name argument could make an entrypoint declared for one MCP tool execute a different tool, while allow-lists, confirmation requirements, human approval and logging continued to resolve against the declared name.

The same release changes tool-result caching to include stable user and session identity, and makes unresolved persisted-component references fail before strict execution paths run. Together, the fixes expose one operational rule: the approved action, executed action, recorded action and principal-scoped state must remain the same control object across the whole runtime path.

The declared tool was not necessarily the executed tool

Agno's MCP entrypoints used a partially applied function to associate an entrypoint with a tool name. In Python, a keyword supplied when the partial function is called can override the default captured when the partial was created.

According to Agno's release and patch record, a model could therefore call the entrypoint built for one tool while supplying another tool's name at call time. The MCP server would execute the supplied tool, but the surrounding framework would still evaluate the allow-list, requires_confirmation, human-in-the-loop approval and logging against the entrypoint's declared name.

That is not merely a tool-selection bug. It is a break in control identity. A benign declared operation could receive approval while a different operation crossed the execution boundary.

The v2.9.0 fix removes the call-time selector from the execution decision and closes over the actual MCP tool's name. A model-supplied tool_name remains an ordinary argument for tools whose schemas legitimately declare one, but it can no longer choose which tool executes.

Approval is meaningful only when it binds to the exact action that crosses the execution boundary.

Sources: Agno v2.9.0 (opens in a new tab) and Agno pull request #9379 (opens in a new tab).

Identity must follow execution into the cache

The release also changes cache-key construction for tools using cache_results=True. Agno reports that a run-context-aware tool could previously serve one user's cached result to another because the cache key did not include stable principal context.

The new key incorporates user_id and session_id. It deliberately excludes run_id, preserving reuse across separate runs belonging to the same user and session boundary.

This is the same control-path problem in another form. A tool can perform the correct authorization check during its first execution and still disclose the resulting data later if a shared cache forgets who produced it. Authorization at the function boundary does not secure a result after it becomes reusable state.

The governance requirement is therefore broader than “check the caller.” Principal identity has to survive every reuse layer: dispatch, cache lookup, memory retrieval, persistence, telemetry and any downstream action that consumes the result.

Broken state should fail before it runs

Agno v2.9.0 also changes persisted-component rehydration. A stored agent, team or workflow with unresolved references could previously degrade silently: tools could become an empty list, team members could disappear, or schemas and knowledge could be dropped before the reduced component ran.

Strict AgentOS lookup and dispatch paths now raise a ComponentRehydrationError with status code 422 and name the unresolved piece. Public from_dict and load calls remain lenient by default, so the change is explicitly tied to the caller and execution path rather than imposed on every round trip.

Failing loudly is a governance property when missing state changes authority or behavior. If a component loses a tool, policy object, team member or schema during reconstruction, continuing to execute is not graceful degradation unless the reduced configuration was separately authorized.

The release's new identity-aware StudioRunnerTools follows the same direction by threading the caller's user_id into sub-runs. Dispatch identity, stored state and execution state are being treated as connected concerns rather than isolated framework features.

A release note is evidence of a fix, not universal safety proof

The evidence is strong for what Agno says changed: v2.9.0 is an official release, the linked fixes are public, and the MCP patch includes a concrete reproduction and regression tests. The release was published on August 13 at 12:08:15 UTC, inside the August 14 Keelbase Signal window.

The record does not establish how many deployments exposed the affected paths, whether the defects were exploited, or whether every adjacent identity and approval path is now secure. No CVE, vendor advisory with affected-version analysis, or independent security audit was identified in this review.

The MCP issue applies to Agno's MCP tool entrypoints. The cache issue applies when result caching is enabled for run-context-aware tools. Those scopes matter; they should not be generalized into a claim that every Agno deployment leaked data or allowed arbitrary tool execution.

The implementation fixes were merged before the release date. The in-window event is their public inclusion and disclosure in v2.9.0, not the earlier patch activity.

Bind the whole control path

Governed agent runtimes should test a simple invariant: the artifact evaluated by policy must be the artifact that executes, and the identity attached to the execution must remain attached to every result and derived state.

That means binding approval to an immutable tool identity rather than a model-controlled selector; deriving logs from the executed action rather than the requested label; including principal scope in cache and memory keys; refusing execution when required configuration cannot be reconstructed; and verifying those properties at the final dispatch boundary, not only in the planning layer.

Human approval does not repair an ambiguous runtime. If the system can change the meaning of the approved action after the person clicks, the person did not authorize what ran.

Sources and limitations

Agno's release and linked pull requests are first-party engineering records. They describe concrete defects and fixes but are not an independent audit, exploitation report or comprehensive affected-version advisory.

Research papers discovered in the August 13 cs.AI batch were submitted before the rolling window and were not promoted as August 14 structured records. Batch appearance is a discovery route, not a new publication event.