Open Computer Use EUVD-2026-96995

Requires all of the following: Open Computer Use version <=1.0.0 installed on macOS; the agent granted accessibility (and screen-recording) permissions; a targeted password manager such as 1Password installed and currently in an unlocked state; and the attacker operating as a local MCP caller OR achieving prompt injection into a model turn (which is the realistic trigger). The core technique is supplying a case-variant bundle identifier (e.g. 'com.1Password.1Password' instead of the canonical casing) so the denylist string comparison fails to match. Limiting factors: local-only vector (no remote network reach), the password manager must already be unlocked (reflected by AT:P/UI:P), and the agent must already hold macOS accessibility permissions - a non-trivial, user-granted precondition. Impact is confined to this one product's tool surface.

This is a moderate, conditional risk rather than an urgent priority. The CVSS 4.0 score of 5.8 (Medium) is consistent with the vector: local attack vector (AV:L), present attack requirements (AT:P), and passive user interaction (UI:P) all constrain exploitation, while the high confidentiality impact (VC:H) reflects the serious consequence of exposing an unlocked password manager. No EPSS score, CISA KEV listing, or SSVC decision was supplied, and no public exploit identified at time of analysis - though a detailed technical write-up (hackmd) and the exact vulnerable source lines (AppDiscovery.swift) are referenced, which materially lowers the barrier to reproducing the bypass. The most important real-world amplifier is that exploitation does not strictly require a separate human attacker: the description explicitly notes prompt-injected model turns can trigger it, meaning a malicious document or webpage processed by the agent could drive the chain autonomously. Net: a genuine and clever denylist-bypass flaw, but its real-world impact is gated by a narrow precondition stack (specific product installed, accessibility permissions granted, password manager unlocked) and an obscure deployment footprint, so it rates well below its clever technical merit.

A user runs Open Computer Use (<=1.0.0) on macOS with accessibility permissions and leaves 1Password unlocked. A prompt-injection payload hidden in content the agent processes instructs it to call get_app_state with the case-variant bundle identifier 'com.1Password.1Password', slipping past the denylist, which only matches the canonical lowercase form. The agent then reads the accessibility tree and captures screenshots of the unlocked vault, leaking stored credentials. No standalone exploit tool is published, but the referenced write-up and source lines make reproduction straightforward.