AutoAgent CVE-2026-86124: an agent framework with no auth

CVE-2026-86124 landed on September 5. AutoAgent — the HKUDS "fully-automated, zero-code LLM agent framework," about 9.8k stars on GitHub, MIT licensed — runs a TCP server that binds to all interfaces and executes attacker-supplied commands as root, with no authentication in front of it. The classification is CWE-306, missing authentication for a critical function. It scores 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1. The CVE record marks all versions affected.

There is no clever exploit chain here. There is a socket, and it runs your commands.

What actually happened

AutoAgent ships a Docker-based interactive environment so the agent can run code somewhere disposable. The container talks to the framework over a TCP control channel. That channel binds to 0.0.0.0 — every interface on the host, not just the loopback address it needed — and it does not check who is connecting. Anyone who can reach the port gets arbitrary bash execution as root inside the container.

"Inside the container" is doing less work than you would like. The advisory specifically calls out bind-mounted host workspace directories, which is exactly how you use a tool like this: you mount the repo you want the agent to work on. That mount is the bridge out. Whatever the agent could read and write, the attacker can now read and write.

The scored attack profile is network vector, low complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability impact. As of today the CVE record lists no fixed release. Mitigation is yours: bind it to localhost, firewall the port, and do not run this on anything with a public IP.

Why AI agent frameworks matter for your business

The AI agent ecosystem is roughly where self-hosted web apps were in 2011. Fast-moving research code, MIT license, a Docker one-liner in the README, and an implicit assumption that you are running it on a laptop behind NAT. Then somebody deploys it to a cloud VM so the team can share it, and the assumption quietly stops being true.

This is not a reason to avoid open-source agent tooling. We run plenty of it. It is a reason to treat "what ports does this open" as a required step before anything gets a public IP. Concretely, for every agent framework in your stack:

• Run docker ps and look at the published port column. Anything mapped to 0.0.0.0 is reachable from the internet if the host is.
• Assume any control channel with no visible auth in the docs has none.
• Never bind-mount a directory the agent does not strictly need. That mount is the container boundary, and it is the boundary attackers cross.
• Put agent tooling behind a VPN or a reverse proxy with authentication. Not behind obscurity.

The pattern across this year's agent CVEs is not exotic memory corruption. It is authentication that was never written, on services that were never supposed to leave localhost.

Sources: CVE-2026-86124 record, OffSeq Threat Radar analysis, HKUDS/AutoAgent on GitHub.