CVE-2026-62675 is not a coding error — it's a threat modeling failure. The vulnerability exists because the framework treats authenticated users as implicitly trusted to execute arbitrary code once past the authentication gate. This collapses the distinction between configuration and execution in ways that bypass security boundaries without requiring any privilege escalation. The CVSS 8.8 rating with 'no administrator privileges required' is the signal: the attack surface lives entirely within the intended workflow.
The core issue is that arbitrary Python callables are accepted as legitimate bundle configuration. An authenticated user can submit a bundle that doesn't describe what the agent should do — it contains the code to do it, invoking callables within the runner's process space. The authentication gate exists, but the execution model inside treats 'authenticated' as synonymous with 'permitted to run anything the runner can reach.'
Whether version 0.3.0 uses an allowlist or blocklist approach determines the durability of the fix. A blocklist — 'if path not in BLOCKED_PATHS' — is a band-aid; it's version-locked to the specific callable discovered. An allowlist — 'if path in ALLOWED_PATHS' — is architecturally different but introduces an ongoing maintenance obligation: someone must govern which modules constitute safe extensibility as the dependency graph evolves.
The blast radius in an AI agent context exceeds the CI/CD analogy. A compromised GitHub Actions runner exposes secrets; a compromised AI agent runner exposes the agent's operational context — prompt history, accumulated reasoning, model session state. That's not just credential theft; that's competitive intelligence and internal architecture knowledge.
Your priorities: verify whether 0.3.0 implements allowlist or blocklist validation (the CVE description omits this). If it's blocklist, treat the vulnerability as unfixed and plan accordingly. Regardless, question whether authenticated users and untrusted code authors should be the same entity in your threat model — if they are, authentication provides no meaningful security boundary. The sustainable fix separates configuration (what the agent should do, declaratively) from execution (what mechanisms the platform permits).