AgentGPT

Every backend agent request is tied to a logged-in user via a session token, and the optional Sid connector uses that user's own OAuth grant with minimal read-only scopes. The vendor keys the server uses (OpenAI, Serper, Replicate) are operator-wide account keys shared by every user, but the model can only use them through fixed, narrow API calls. Authentication in the default install and per-resource authorization are not locked down.

AgentGPT has no consequential actions. Its tools search Google through Serper, generate an image, query the user's Sid index read-only, or ask the model to write or reason in text. None of them write files, send messages, push code, or change state in an outside system, so there is nothing for an approval gate to protect. The tool set is fixed in code. Image generation does spend the operator's money, but that is bounded by the loop limits (scored under C10).

The tools are narrow by construction. Each one calls a single hard-coded endpoint (Serper, Replicate's pinned model or DALL-E, Sid), with fixed quantities (top 5 results, 10 Sid results, one 256x256 image), and the model only supplies a query string. There is no generic HTTP, shell, file or SQL tool. A central validator checks that the chosen action is a known tool name. Gaps: argument handling is not strict, and the per-task tool selection is not enforced on every path.

No model output is ever executed. The 'code' tool only asks the model to write code as text, which is shown to the user. The only eval-like call in the backend is Python's ast.literal_eval, which parses task lists and cannot run code. The setup CLI does spawn docker-compose, but the model cannot reach it.

Google search snippets go straight into the summarization prompt with no marking or separation, and each step's result is fed into the prompt that plans the next tasks. So a malicious web page can steer the rest of the run. Nothing in code limits what a hijacked run can do afterwards. Output rendering in the frontend is not locked down, which widens what a hijacked run can leak. No irreversible actions exist, which keeps this from being the worst case.

Nothing the model reads persists into later behaviour. The Pinecone memory module is present but never wired into the agent service. Saved runs are stored only for display and are not loaded back into prompts; the chat endpoint gets earlier results from the user's own browser. The backend's .env file is the service's own config, not a workspace the agent works on.

AgentGPT loads no third-party code at runtime: no plugins, no MCP servers, no downloaded tools or model files. Image generation calls Replicate's hosted API with a model version pinned by hash, and nothing is executed locally.

API keys come from environment variables and are never put into prompts. OAuth tokens for the Sid connector are encrypted at rest with Fernet, and errors from users' own API keys are kept out of the logs. But key management for that encryption is not locked down. Summarization text is logged at INFO level by default. The vendor keys are long-lived and cover the whole account.

Before each loop step runs, the backend writes a row recording the step type, linked to a run that stores the user and the goal. Because the row is written first, a database failure stops the step. But the record leaves out which tool ran, its arguments, and its result. The full conversation is saved only when the browser chooses to save it, so a run cannot be rebuilt from server-side records.

The server caps how many times each step type can run per run: 25 by default, but the setup CLI sets it to 100. Per-call output tokens are also capped per model. There is no wall-clock limit, no cost cap, and no per-user cap on how many runs can be started. Stopping is a flag in the browser that ends the loop and cancels the stream being read. Because the backend is stateless per request, nothing keeps running server-side after a stop.