OpenAI Agents SDK hands full history to other agents
LowAV-FW-016PermissionsFramework packNew in 2.0
What it finds
Agents hand off to each other with no input_filter, so each receiving agent gets the full conversation and tool history.
Why it matters
Data one agent was allowed to see (tool results, documents) is passed to agents that may have different tools and trust levels.
What an attacker could do: Sensitive tool output can reach agents that should not see it.
How to fix it
Add an input_filter to handoffs (for example handoff_filters.remove_all_tools) to pass only what the next agent needs.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- OPENAI_AGENTS_HANDOFF_NO_FILTER
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent source using the named framework (LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, computer-use tools)
- OWASP LLM Top 10
- LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- GV-4.1
- SOC 2
- C1.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- Unscoped delegation detectedAV-PERM-002 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High