Click, Parse, Execute - When a GUI Agent's Control Plane Becomes a Remote Control Surface

Discovered a critical RCE vulnerability in Microsoft's OmniParser/OmniTool where an unauthenticated execution surface on the VM controller could allow attackers to remotely control GUI agents. Microsoft assigned CVE-2025-55322 and shipped a fix.