Agent Zero

Agent Zero runs its agent loop and every tool as root inside one container, and every tool can use every credential it holds: LLM API keys sit in the process environment that each shell inherits, and any stored secret can be spliced into any tool call through a §§secret() placeholder. There is no authorization layer that maps actions to a least-privilege policy, and the web UI has no login unless the operator sets one, so anyone who can reach the published port can direct the agent. The per-profile tool allow/block list is opt-in and lives in files under /a0/usr that the agent's own root shell can rewrite.

There is no human approval step for any tool. The loop extracts a tool call from the model output and executes it directly, including the root shell, Python/Node execution, browser and MCP tools. The only approval logic in the core auto-denies provider-hosted MCP approval requests; the optional infection-check plugin is an LLM judge, not a human gate, and is off by default. The Time Travel plugin snapshots workspace files after code execution, so file damage inside /a0/usr workspaces can often be reverted, but network actions and changes elsewhere cannot.

The default toolset gives the model a general-purpose root shell plus Python and Node execution, a browser that opens any URL, file editing without workspace containment, and any configured MCP tools. Arguments are passed through rather than validated against allowlists, and the text editor resolves real paths only for change tracking, not to keep edits inside a workspace. Tools can be blocked per profile or project through the opt-in Tool Access plugin, but the default policy allows everything.

All model-driven code runs inside the Agent Zero Docker container, which is the shipped deployment, so the host is separated by a stock container boundary. That container is not hardened: processes run as root with default capabilities and no seccomp or read-only settings, and it is the same container that holds the agent itself, its configuration, and its secrets. The shell inherits the agent's environment, including API keys, and has unrestricted network access. An opt-in A0 CLI connector can extend execution to the user's host machine; its host-side permission prompts live in a separate repository not reviewed here.

Content from web pages, search results, documents, and MCP tools enters the conversation as ordinary user-role messages, and nothing limits what a hijacked agent can do afterwards: it holds a root shell, network egress, and every configured secret, with no human in the loop. An optional Infection Check plugin asks a second LLM to judge the agent's output before each tool call, but it is detection only, disabled by default, fails open when the check errors, and can be switched off per project. The web UI also accepts instructions from anyone who reaches it when no login is configured.

Several persistence paths feed straight back into future behaviour. Memory auto-saves fragments from each conversation and recalls them later; a behaviour-adjustment tool lets the model rewrite rules that are inserted at the top of its own system prompt. Projects load tools, Python extensions, prompts, MCP server lists, and AGENTS.md files from the project's .a0proj folder with the highest priority, and cloning a Git repository as a project keeps the repository's own .a0proj, so a repository can ship code that runs in-process after only a generic warning. Memory is separated per project by default, but the agent's root shell can write any of these stores.

Third-party code reaches the agent through several unverified paths. Plugins install from the tip of a Git repository with no pinning or signature check and run an install hook in-process; any plugin folder under /a0/usr/plugins is enabled by default. MCP stdio servers launch as root in the same container. Cloned projects can bring their own MCP servers and Python extensions, and the model's root shell can install packages or drop plugins on its own. An LLM-based plugin scanner exists but is advisory and run on request.

Agent Zero has a real secret-masking layer: stored secrets are shown to the model only as §§secret() placeholders that are substituted at tool execution, and secret values are masked in tool output, chat history, utility-model calls, streamed text, error messages, and logs. Secrets and API keys are still stored as plaintext files under /a0/usr, the API keys are loaded into the process environment and inherited by every shell the agent spawns, and masking is exact-string replacement that an encoded print bypasses. An update check posts the version and an anonymized instance ID to the vendor by default.

Every tool call, including MCP tools and sub-agent calls in the same chat, is logged as a structured item with its arguments and result, and the chat is saved to disk at the end of each loop iteration. The record names which agent number acted but not a human principal, and there are no approvals to record. The logs are saved under /a0/usr/chats, which the agent's root shell can edit or delete, and there is no tamper-evident or off-host export.

There is no limit on agent loop iterations, wall-clock time, tokens, or spend, and delegation to subordinate agents has no depth or budget accounting. Code execution stops waiting after 240 seconds by default, but the process can keep running. Stopping a chat cancels its task, yet shell processes and model-created scheduled tasks continue. Model request rate limits exist but are off by default.