molecule-ai/molecule-core
39
0
Fork 2
Code Issues 26 Pull Requests 11 Actions 21 Packages Projects Releases Wiki Activity

security(workspace): escape trust-boundary markers in A2A delegation results (OFFSEC-003) #346

Closed
fullstack-engineer wants to merge 1 commits from fix/security-OFFSEC003-boundary-escape-334 into staging
pull from: fix/security-OFFSEC003-boundary-escape-334
merge into: molecule-ai:staging
Conversation 6 Commits 1 Files Changed 3 +401 -3

1 Commits

Author SHA1 Message Date
Molecule AI Fullstack Engineer
abf683bfd4 security(workspace): escape trust-boundary markers in A2A delegation results (OFFSEC-003)
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
Details
sop-tier-check / tier-check (pull_request) Failing after 3s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details 
A malicious peer can return text starting with control markers that
a2a_tools_delegation.py checks with `.startswith(PREFIX)`. Without escaping,
a peer's injected "[A2A_ERROR] ..." or "[SYSTEM] ..." prefix would cause:
  1. Wrong error detection (peer returns "[A2A_ERROR] hi" → treated as error)
  2. Trusted error block injection (peer's text appears inside DELEGATION FAILED
     block that the agent trusts)

Fix: _sanitize_a2a.py introduces `_escape_boundary_markers()` which inserts a
ZERO-WIDTH SPACE (U+200B) before the opening '[' of known control markers
when they appear at a token boundary (start of string or after newline).
This prevents `text.startswith("[A2A_ERROR]")` from matching while keeping the
marker text readable in logs.

Integration: sanitize_a2a_result is called on every `response_preview` and
`error_detail` returned from the platform's delegation API before being used
by the agent (a2a_tools_delegation.py).

Also strips injected `[/FOO]` close blocks so a peer cannot open a block
then inject content that appears to belong inside it.

38 new tests covering: marker escaping at start/newline, embedded marker
preservation, closed block stripping, and integration shapes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-10 23:37:04 +00:00