VulnCheck published CVE-2026-76066 (CVSS 4.0 8.7, CWE-862) on Oct 15 for IntentKit through 2.6.3, an open-source autonomous-agent framework whose agents can hold crypto wallets. The executor checked tool calls against the full tool registry instead of the narrowed per-request tool list, so owner-only, state-changing tools such as wallet transfer, posting, memory-write and call-agent could run with no approval gate. An unauthenticated or public caller in web, API, Twitter or Telegram contexts can trigger them by supplying the de-advertised tool name and arguments through indirect prompt injection, or by replaying checkpoint/history data on a reused thread. Credit: Noy Pearl, Michael Sromin and Ophir Dror (Lasso). VulnCheck lists no patched version. Lesson for any harness: enforce the allowed tool set at execution time, not just in what the model is shown.