tier1Gate reset swallows failure silently — gate can remain armed
Finding PUB-F007 · 0e4cb3fc39dd · discovered by pentest-public-51classes-20260611
MEDIUMconfirmedagent-goal-hijackingopus48artifact backed
- Target
- OhanaSec/jc-pentest-harness
- Target URL
- not recorded
- Run status
- completed · api-multi-model
- Framework
- agentic
- Priority score
- 0.5200
- Reachability
- unknown
- Chain depth
- 1
- PoC available
- no
- Asset
- not recorded
- Discovered
- Jun 11, 2026, 02:20 PM
Description
The tier1Gate reset path swallows exceptions, so a failure during reset can leave the gate armed for a subsequent run with no operator signal.
Validation
No validation rationale recorded.
Remediation
Fail closed on reset error; surface a hard error and require explicit re-arm.
Evidence Boundary
This page shows persisted finding evidence, validator rationale, target context, and run linkage. Raw prompts, raw target responses, provider payloads, secrets, cookies, and authorization headers are not rendered publicly. Use the linked run page for class execution evidence, run logs, cost events, and pipeline errors.