Several Agent API endpoints appear to lack authentication #7

Open
opened 2026-08-06 22:11:09 +08:00 by Jonashuang · 1 comment

The Agent run, approve, and resume endpoints do not appear to enforce authentication or authorization. This may allow unauthenticated users to invoke or manipulate Agent operations.

The Agent run, approve, and resume endpoints do not appear to enforce authentication or authorization. This may allow unauthenticated users to invoke or manipulate Agent operations.
Owner

Thank you for flagging this issue. We have classified it as a P0 security item and are currently auditing the actual deployment scope and server-side authorization boundaries of the run, approve, and resume endpoints.

Once the remediation is complete, every sensitive Agent operation will require server-side identity verification and an ownership check for the corresponding run or session. Unauthenticated requests will return 401, while authenticated users attempting to access another user’s session will receive 403. Approval actions will be bound to a specific user, run, and step, with an expiration time and one-time-use enforcement to prevent forgery, cross-session access, and replay. Failed authorization checks will not invoke models, execute tools, or consume related service resources.

We will also add rate limiting, security audit events, and automated tests covering unauthenticated access, cross-user access, forged identities, expired approvals, and approval replay. The guest Demo will remain available, but it will not grant access to sensitive Agent endpoints or external execution capabilities.

The remediation is still in progress, and we will not claim that the production issue has been resolved until the implementation and deployment have been fully verified. Once complete, we will provide the security fix commit, test results, and confirmed deployment status. Thank you again for helping us identify this important server-side security boundary issue.

Thank you for flagging this issue. We have classified it as a P0 security item and are currently auditing the actual deployment scope and server-side authorization boundaries of the `run`, `approve`, and `resume` endpoints. Once the remediation is complete, every sensitive Agent operation will require server-side identity verification and an ownership check for the corresponding run or session. Unauthenticated requests will return `401`, while authenticated users attempting to access another user’s session will receive `403`. Approval actions will be bound to a specific user, run, and step, with an expiration time and one-time-use enforcement to prevent forgery, cross-session access, and replay. Failed authorization checks will not invoke models, execute tools, or consume related service resources. We will also add rate limiting, security audit events, and automated tests covering unauthenticated access, cross-user access, forged identities, expired approvals, and approval replay. The guest Demo will remain available, but it will not grant access to sensitive Agent endpoints or external execution capabilities. The remediation is still in progress, and we will not claim that the production issue has been resolved until the implementation and deployment have been fully verified. Once complete, we will provide the security fix commit, test results, and confirmed deployment status. Thank you again for helping us identify this important server-side security boundary issue.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Jyoti/TradePilot_S3#7
No description provided.