Evidence record / agent-zero
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permission
Remote input has its own execution-capable permission ID. code_execution_remote no longer accepts runtime=input. The replacement input_remote dispatches runtime=terminal with framework-owned _allow_running=True. Running shells receive input; idle or missing shells execute the text as a command. Canonical policy IDs are matched independently, so blocking plugin:_a0_connector:code_execution_remote while leaving Tools default allow does not block plugin:_a0_connector:input_remote. It still requires the host connector’s exec and write grants. The local input tool also has a separate ID from code_execution_tool. Interactive CLI exec defaults off; ACP connection defaults differ (section 9).
Channel: tagged-release. Half: both. Date: 2026-09-23 (first stable; implementation 2026-09-12).
Operator consequence: Block both remote execution/input IDs wherever host commands are forbidden, and both local IDs where local commands are forbidden; alternatively default Tools to block and allow deliberately. Verify denial through a subagent. Migrate old runtime=input scripts and upgrade the host CLI with the framework. The new chat namespace is state separation, not a permission fix.
Receipt
- https://github.com/agent0ai/agent-zero/commit/a2dc9dc8d74e5011b2bbf4c2cf3630481581215e
- https://github.com/agent0ai/agent-zero/blob/v2.14/plugins/_a0_connector/tools/input_remote.py
- https://github.com/agent0ai/agent-zero/blob/v2.14/helpers/tool_policy.py#L161-L194
- https://github.com/agent0ai/a0-connector/blob/v2.13/src/agent_zero_cli/remote_exec.py#L800-L823
- https://github.com/agent0ai/a0-connector/blob/v2.13/tests/test_remote_exec.py#L405-L425
- https://github.com/agent0ai/a0-connector/blob/v2.14/src/agent_zero_cli/remote_exec.py#L588-L603
- https://github.com/agent0ai/agent-zero/blob/v2.14/plugins/_code_execution/tools/input.py
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permission
Profile citations
- Agent Zero / claim / input-and-exec-permission-ids
- Agent Zero / posture / governance
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissiongithub.com/agent0ai/agent-zero/commit/a2dc9dc8d74e5011b2bbf4c2cf3630481581215etagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/agent-zero / plugins/_a0_connector/tools/input_remote.pytagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/agent-zero / helpers/tool_policy.py#L161-L194tagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/a0-connector / src/agent_zero_cli/remote_exec.py#L800-L823tagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/a0-connector / tests/test_remote_exec.py#L405-L425tagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/a0-connector / src/agent_zero_cli/remote_exec.py#L588-L603tagged commit file2026-10-13-agent-zero-remote-input-has-its-own-execution-capable-permissionagent0ai/agent-zero / plugins/_code_execution/tools/input.py
Versioned source: run artifact