AckuityRequest access GitLab fixed CVE-2026-96893, a High-severity Duo Agent Platform flaw that could cause unintended commands to be attributed to another user.
THE CONTROL LESSON
What should we watch for?
Ackuity’s view: check instruction provenance alongside the user’s authority and the requested action before allowing execution.
THE EVIDENCE
What does the report establish?
This is a vulnerability disclosure, not evidence of exploitation. The advisory describes a potential outcome. The animation’s User A and User B flow illustrates that risk; GitLab has not published those specific mechanics.
Read the full account
GitLab’s October 12 advisory describes crafted input affecting AI agent instructions. It rates the flaw CVSS 7.3 and credits internal discovery by Mert Coskuner. Fixed releases are 19.2.8, 19.3.5 and 19.4.2. GitLab.com is patched; Dedicated customers need no action. Self-managed users should upgrade.
A record of whose name an action carries may not establish who supplied its instructions.
ORIGINAL REPORTING & EVIDENCE