Agno had a confused-deputy bug that let a model bypass every approval gate.

PR #9379, merged August 6, fixes MCP tool entrypoints built as functools.partial(call_tool, tool_name=tool.name). Partial keyword defaults get overridden by call-time kwargs, so a model passing tool_name="delete_repo" as an argument to any MCP tool executed delete_repo while allow-lists, requires_confirmation, human-in-the-loop approval and logging all resolved against the declared function name. Your HITL gate was decorative. If you wrote a framework where approval and execution read different identifiers, go check it today.