claim evidence · new to this desk · high confidence
Mistral discloses high-severity Vibe permission flaws and fixes
Reviewed research snapshot 2026-09-18T20:39:19Z · Event 2026-09-14 · Detected 2026-09-15T22:27:11Z · Global
What changed
Mistral's advisory describes six Vibe shell permission vulnerabilities. Version 2.25.4, released September 12, addresses remaining reported bypasses; users are advised to upgrade.
Materiality: Actionable high-severity agent control vulnerabilities require customer remediation.
Research interpretation
Permission enforcement failures can expose files and execution authority, affecting safe agent deployment.
Why now?
Post-freeze coverage remediation; original publication date retained. Review today does not mean event occurred today.
What would change this view?
Confirm: Independent verification of fixes and adoption of patched versions.
Weaken: Reproducible bypasses in claimed fixed versions.
Narratives affected
AI safety pressure ↑ · analyst strength 2/3
Permission enforcement failures can expose files and execution authority, affecting safe agent deployment.
Potential exposure
Agent permission controls — Actionable high-severity agent control vulnerabilities require customer remediation.
A relationship does not establish revenue, token value capture, or causal price impact.
What remains uncertain
- Exposure does not prove compromise or in-the-wild exploitation.
- Some vulnerabilities were fixed earlier; not all prior versions share every flaw.
- September 14 is advisory publication, not patch or exploitation date.
Primary evidence trail
Mistral discloses high-severity Vibe permission flaws and fixes ↗
Mistral · primary · Published 2026-09-14
Observed 2026-09-15T22:32:23Z
Primary source reviewed; announcement or advisory scope only.
Event lineage
Canonical event identity: mistral|mistral-vibe-permissions-mai-2026-003
No earlier version superseded.