A CVSS 9.9 usually means unauthenticated. This one does not, and it is worth understanding why it scores that high anyway.

Manifold Security reported a flaw in Odysseus, an AI workspace, affecting versions before 1.0.2. It allows an authenticated, non-admin user to execute operating system commands with the privileges of the Odysseus process itself.

So: an ordinary account. Not an administrator. Someone with a login.

What the account reaches

The researchers' description of the impact is the clearest statement of why AI workspaces are a distinct risk category:

one account became a foothold — API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages

Each of those is a different kind of loss.

API keys to spend. Model API credentials are billable. Theft here is not only data exposure; it is a bill, and one that can run for a while before anyone reconciles it.

A mailbox to send from. Sending as the organisation is a phishing capability with the organisation's own domain reputation behind it — and internal recipients who have no reason to doubt it.

SSH keys to the machines it manages. This is the one that turns a product vulnerability into an infrastructure incident. The workspace was given those keys so it could do its job. Whoever holds them inherits the same reach.

The privilege model is the problem

Traditional software gets deployed with the narrowest privileges that let it function. An AI workspace is the opposite by design: its usefulness is proportional to how much it can touch. Connect the mail system, the repositories, the cloud accounts, the internal services — that is the product working as sold.

Which means the gap between "a user account" and "the platform's own privileges" is enormous, and the exploit only has to cross it once.

An authenticated flaw in a conventional application gets the attacker what that application does. An authenticated flaw here gets them what the platform was integrated with, which is usually everything anyone thought to connect.

That is why the score is 9.9 despite requiring credentials. The requirement is real; it is just cheap. A phished password, a reused credential, a departing contractor's account, a self-service signup on a shared tenant — none of that is exotic.

What is not being claimed

Worth stating plainly: there is no evidence of exploitation before the fix. This was found and reported by researchers, not discovered in an incident.

The fix is in 1.0.2. If you run Odysseus, upgrading is the whole action item.

The general lesson for anyone deploying AI workspaces

Most organisations adopting these tools evaluate them the way they evaluate SaaS: does it do the job, is the vendor credible, does it have the certifications. That misses the property that makes them different.

  • Inventory what the platform holds, not what it does. The security question is not "what does this tool do" but "what would someone have if they became this tool". Write that list down. It is usually longer than expected.
  • Scope integrations to the task. An AI workspace with SSH keys to production because someone wanted a convenience once is a permanent liability for a temporary need.
  • Separate the credentials it uses from the ones you care about. Dedicated service accounts with their own limits mean the blast radius is bounded and the theft is visible in billing.
  • Treat "authenticated" as a weak barrier here. For a platform with this much reach, an authenticated-only vulnerability is not meaningfully safer than an unauthenticated one.

The specific bug is fixed. The architecture that made an ordinary account worth 9.9 is not a bug at all — it is the value proposition, viewed from the other side.