PYSEC-2026-2946 — PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

PraisonAI Agents caches tool approval by tool name rather than invocation arguments. After one execute_command invocation is approved, later invocations in the same execution context may bypass the approval prompt. Combined with passing the full process environment to subprocesses, this may allow an LLM agent, including one affected by prompt injection, to output environment variables and obtain credentials without further user consent.