Disclosed weakness · no CVE recorded

Agent file reads on Windows can send authentication to an untrusted share

GitHub, OpenAI and Google · GitHub Copilot, Codex CLI and Antigravity on Windows

First documented disclosure · Review checkpoint

Summary

Cymulate observed three agents trigger automatic Windows authentication when asked to read or list a remote path.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Cymulate reports controlled observations. The report identifies no production victim for this technique.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A file tool resolves a UNC network path supplied through untrusted content. Windows contacts the file server using the current user’s authentication context.

Conditions required

The agent follows the instruction, the attacker controls a reachable share and Windows permits outbound NTLM authentication to it.

Potential impact

The remote server can receive NTLM challenge-response material. Further use depends on the account and network controls.

Affected versions and configurations

Cymulate names three products. It does not identify affected build ranges for this behavior.

Fix and mitigation status

No issue-specific fixed build was established for the three tools.

Practical next steps

Limit agent file access to approved local paths and shares. Restrict outbound SMB and NTLM to approved destinations, then test the controls from a managed agent session.

Operating lesson

Treat a network file read as a potential authentication request before granting the tool access.

Evidence and limits

November 3 is the earliest written account verified for this specific behavior. The article also describes two conference demonstrations. Their cloud outcomes and the CVEs for other bugs are separate from this finding.

Sources