A CVE About AI Agent Permissions Made Me Re-Check What Our Own Agent Could Touch

Description and use

<p>Earlier this month, a critical vulnerability showed up in GitLab's AI Gateway — CVE-2026-90970, CVSS 9.9, letting a logged-in user with agent platform access run commands on the gateway itself. I read the advisory the way most people probably did: nodded, thought "glad that's not us," and moved on.</p> <p>Then I actually thought about our own setup for about ten more seconds, and the "glad that's not us" feeling evaporated.</p> <h2> What we had built, and why it felt safe </h2> <p>We'd wired an internal AI agent into our infra for the usual reasons — it could read logs, query our internal A

Problem

<p>Earlier this month, a critical vulnerability showed up in GitLab's AI Gateway — CVE-2026-90970, CVSS 9.9, letting a logged-in user with agent platform access run commands on the gateway itself. I read the advisory the way most people probably did: nodded, thought "glad that's not us," and moved on.</p> <p>Then I actually thought about our own setup for about ten more seconds, and the "glad that's not us" feeling evaporated.</p> <h2> What we had built, and why it felt safe </h2> <p>We'd wired an internal AI agent into our infra for the usual reasons — it could read logs, query our internal A

Outcome

<p>Earlier this month, a critical vulnerability showed up in GitLab's AI Gateway — CVE-2026-90970, CVSS 9.9, letting a logged-in user with agent platform access run commands on the gateway itself. I read the advisory the way most people probably did: nodded, thought "glad that's not us," and moved on.</p> <p>Then I actually thought about our own setup for about ten more seconds, and the "glad that's not us" feeling evaporated.</p> <h2> What we had built, and why it felt safe </h2> <p>We'd wired an internal AI agent into our infra for the usual reasons — it could read logs, query our internal A

Evidence

A CVE About AI Agent Permissions Made Me Re-Check What Our Own Agent Could Touch

Source