Agent API keys can hijack Telegram bindings in Abilityai Trinity

A missing authorisation vulnerability in Abilityai's Trinity lets agent-scoped API keys carry out operations that were meant to be limited to human users, according to an entry published to the US National Vulnerability Database on 11 October 2026. The flaw is tracked as CVE-2026-108756 and affects Trinity through version 0.9.5.

The problem sits in Trinity's Telegram router, the server-side code that handles the link, or "binding", between a Trinity account and a Telegram bot. According to the NVD entry, the binding routes do not check whether the caller is a human user or an agent. That means an agent-scoped MCP API key — the credential an agent presents when calling the platform's tools — is accepted for binding operations that are supposed to be human-only.

The practical consequences are set out in the advisory. An attacker who controls an agent, the NVD says, typically through prompt injection, can send messages using the owner's bot token. Prompt injection is the technique of smuggling instructions into text an agent reads so that it follows the attacker rather than its operator. The same access allows the attacker to replace the binding with a bot token of their own, or to delete the binding altogether.

That combination matters because each step builds on the last. Sending messages through the owner's bot means anything the attacker writes appears to come from a trusted account. Replacing the binding with an attacker-controlled token redirects the channel. Deleting it removes the channel from the owner. None of these actions requires the attacker to obtain a human user's credentials; the agent's own key is enough.

The NVD entry references two specific ranges in the project's Telegram router source file on GitHub, covering the handlers involved, along with the Trinity repository itself, a write-up hosted on HackMD and an advisory from VulnCheck. The VulnCheck advisory describes the issue in the same terms, as missing authorisation in Trinity's Telegram binding routes in versions through 0.9.5.

The record for this issue lists its status as reported. The sources available do not state whether a fixed release is available, and no patched version number is named in the NVD entry. Abilityai has not published a statement in the material referenced by the advisory.

The case is a compact illustration of a design question that keeps recurring in agent platforms. When an agent holds a credential, that credential is only as safe as the agent's input. If the server does not distinguish between a request made by a person and a request made by an agent acting on that person's behalf, any instruction the agent is tricked into following inherits the person's privileges. Here, the separation existed in intent — some operations were meant to be human-only — but was not enforced at the route level.

Organisations running Trinity 0.9.5 or earlier with a Telegram binding should treat the bot token as exposed to anything their agents read.