CVE-2026-84885: Agent-S CodeAgent Denial of Service Vulnerability

CVE-2026-84885 Overview

CVE-2026-84885 is a denial of service vulnerability affecting simular-ai Agent-S versions 0.3.1 and 0.3.2. The flaw resides in an unspecified function within the code_agent.py file of the CodeAgent component. Attackers can trigger the condition remotely with low privileges and no user interaction. The issue is categorized under [CWE-404: Improper Resource Shutdown or Release]. The exploit has been publicly disclosed. According to the advisory, the vendor was contacted prior to publication but did not respond.

Critical Impact
Remote attackers with low-level access can disrupt availability of the Agent-S CodeAgent component, causing a denial of service condition affecting downstream automation workflows.

Affected Products

simular-ai Agent-S 0.3.1
simular-ai Agent-S 0.3.2
Component: CodeAgent (code_agent.py)

Discovery Timeline

2026-09-03 - CVE-2026-84885 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84885

Vulnerability Analysis

The vulnerability exists within the CodeAgent component of simular-ai Agent-S, specifically in the code_agent.py source file. Manipulation of an unspecified function in this file causes the component to fail to properly release or manage resources, aligning with the [CWE-404] weakness category. The result is a denial of service condition impacting availability while leaving confidentiality and integrity unaffected.

Agent-S is an autonomous agent framework, and the CodeAgent handles code-related tool outputs. When the affected function processes crafted input, it fails to shut down or release resources cleanly. This behavior halts or degrades agent execution, disrupting any pipeline that depends on the affected agent instance.

Root Cause

The root cause is improper resource shutdown or release within the CodeAgent tool output handling logic. The advisory does not enumerate the specific function or resource type. Public technical detail is limited to the GitHub CVE Tool Output Report and the corresponding VulDB entry for CVE-2026-84885.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An attacker who can submit input to the CodeAgent tool output path can trigger the resource handling flaw. Because the exploit has been publicly disclosed, opportunistic use against exposed Agent-S deployments is possible.

No verified exploitation code is available for republication. See the GitHub proof-of-concept report for the disclosed technical details.

Detection Methods for CVE-2026-84885

Indicators of Compromise

Unexpected termination or hangs of Agent-S CodeAgent worker processes tied to code_agent.py.
Repeated malformed or oversized tool outputs delivered to the agent from network sources.
Growth in orphaned file descriptors, sockets, or memory allocations owned by Agent-S processes.

Detection Strategies

Inventory Python environments for simular-ai/agent-s at versions 0.3.1 or 0.3.2 and flag matching installs.
Instrument the CodeAgent runtime to log input size, execution latency, and exceptions raised by code_agent.py.
Correlate agent crashes with immediately preceding network requests to identify triggering payloads.

Monitoring Recommendations

Track process restart counts and resource utilization (CPU, memory, handles) for Agent-S services.
Alert on availability drops in agent-driven automation pipelines that depend on CodeAgent.
Forward Agent-S application logs to a centralized log platform for retention and correlation.

How to Mitigate CVE-2026-84885

Immediate Actions Required

Restrict network exposure of Agent-S CodeAgent endpoints to trusted callers only.
Rate-limit and size-cap tool outputs delivered to the CodeAgent component.
Run Agent-S under process supervision so denial of service conditions trigger controlled restarts.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry, and the reporter states the vendor did not respond to disclosure attempts. Monitor the simular-ai Agent-S repository references and the VulDB entry for updates. Until a fix is published, treat versions 0.3.1 and 0.3.2 as vulnerable.

Workarounds

Isolate Agent-S deployments behind authenticated reverse proxies or API gateways.
Validate and sanitize tool output payloads before they reach code_agent.py processing paths.
Apply resource limits (ulimit, cgroups, container limits) to bound the blast radius of resource exhaustion.

bash

# Example: containerized resource limits to contain DoS impact
docker run --name agent-s \
  --memory=1g --memory-swap=1g \
  --cpus=1.0 \
  --pids-limit=256 \
  --restart=on-failure:5 \
  simular-ai/agent-s:0.3.2