Several Agent API endpoints appear to lack authentication #7
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The Agent run, approve, and resume endpoints do not appear to enforce authentication or authorization. This may allow unauthenticated users to invoke or manipulate Agent operations.
Thank you for flagging this issue. We have classified it as a P0 security item and are currently auditing the actual deployment scope and server-side authorization boundaries of the
run,approve, andresumeendpoints.Once the remediation is complete, every sensitive Agent operation will require server-side identity verification and an ownership check for the corresponding run or session. Unauthenticated requests will return
401, while authenticated users attempting to access another user’s session will receive403. Approval actions will be bound to a specific user, run, and step, with an expiration time and one-time-use enforcement to prevent forgery, cross-session access, and replay. Failed authorization checks will not invoke models, execute tools, or consume related service resources.We will also add rate limiting, security audit events, and automated tests covering unauthenticated access, cross-user access, forged identities, expired approvals, and approval replay. The guest Demo will remain available, but it will not grant access to sensitive Agent endpoints or external execution capabilities.
The remediation is still in progress, and we will not claim that the production issue has been resolved until the implementation and deployment have been fully verified. Once complete, we will provide the security fix commit, test results, and confirmed deployment status. Thank you again for helping us identify this important server-side security boundary issue.