Composite Security Score
34/100
"The OG autonomous agent has 181K stars and 8+ CVEs. The shell command denylist can be bypassed with /bin/./whoami. 'Human-in-the-loop' safety can be skipped for 'safe' commands. Security has improved since the GitHub SOSF program — but you can't patch away architectural decisions."
What is AutoGPT?
AutoGPT is the original "autonomous AI agent" that sparked the 2023 agent hype cycle. With 181,000+ GitHub stars, it remains the most popular project in the category. Founded in 2023 and backed by $12M from Redpoint Ventures, the project has evolved from a standalone autonomous agent into a full platform.
The platform includes the AutoGPT Server (where agents run), a marketplace of pre-built agents, and continuous automation capabilities. The original "Classic" AutoGPT is now legacy code, explicitly out of scope for security support.
AutoGPT has accumulated more CVEs than any other agent framework we've reviewed. The vulnerabilities span code injection, path traversal, command bypass, SSRF, and RCE.
| Year |
CVE |
Severity |
Issue |
| 2023 |
CVE-2023-37273 |
High |
Docker escape (Code Injection) |
| 2023 |
CVE-2023-37274 |
High |
Path traversal → .py file overwrite |
| 2024 |
CVE-2024-6091 |
9.8 Critical |
Shell command denylist bypass |
| 2024 |
CVE-2024-8156 |
High |
Command injection in GitHub Actions |
| 2025 |
GHSA-4c8v |
Critical |
SSRF via IPv6 |
| 2026 |
CVE-2026-24780 |
High |
RCE via "safe" command bypass |
Sources: NVD, GitHub Security Advisories, SecurityOnline
CVE-2024-6091 — The Denylist Bypass (CVSS 9.8)
AutoGPT's shell command security relies on a denylist to block dangerous commands like whoami. The problem: attackers can bypass it trivially.
Bypass Methods
Modified path
/bin/./whoami
Symbolic links
ln -s /bin/whoami /tmp/safe
Full path variations
/usr/bin/whoami
Root Cause: The execution handler fails to normalize command paths before checking the denylist. Simple string matching is security theater when paths can be represented multiple ways.
Impact: 166,000+ projects potentially at risk. Arbitrary shell command execution. Full system compromise possible.
CVE-2026-24780 — When "Safe" Commands Aren't
The RCE vulnerability discovered in January 2026 reveals a deeper architectural flaw in AutoGPT's security model.
How It Works
AutoGPT pre-approves certain commands as "safe" (like find). These execute without requiring human approval. User-controlled input is passed to subprocess.Popen() with shell=True. Attackers inject malicious args (like -exec) into the find command.
# This bypasses human-in-the-loop entirely:
find . -name "*.txt" -exec rm -rf / \;
Why This Matters: The "human-in-the-loop" safety mechanism — supposed to be AutoGPT's primary defense — is completely bypassed for pre-approved commands. The security model assumes certain commands are inherently safe. They're not.
The SOSF Redemption Arc
In March 2025, AutoGPT joined GitHub's inaugural Secure Open Source Fund (SOSF) program. They've made genuine improvements since.
Automated Security Scanning
Dependabot, CodeQL, and Snyk now scan every codebase and container build. CodeQL is wired into every pull request.
Security Agent for PRs
Built a lightweight "security agent" that coaches contributors during code review, turning passive checks into active guidance.
Formal Incident Response
Established formal incident-response workflow. Mapped 28 follow-up security tasks including fuzzing and OSS Scorecard completion.
"Security is not an add-on feature; it's a prerequisite for safe, trustworthy innovation, especially in the age of autonomous AI agents."
— AutoGPT Team, GitHub SOSF Announcement
Expert Warnings
"Any company that decides to use an autonomous agent like Auto-GPT to accomplish a task has now unwittingly introduced a vulnerability to prompt injection attacks."
— Simon Willison, creator of Datasette
"This is an extremely serious risk, likely serious enough to prevent many companies who would otherwise incorporate this technology into their own stack from doing so."
— Dan Shiebler, Head of ML at Abnormal Security
What's Still Broken
Denylist Architecture is Fundamentally Flawed
Can always be bypassed with path variations. This is a design problem, not a bug to patch.
Pre-approved "Safe" Commands Bypass Human Review
The human-in-the-loop mechanism is security theater if pre-approved commands can execute arbitrary code.
Classic/Legacy Code Still in Repo
Explicitly marked "out of scope" for security. Creates confusion about what's supported.
No Public Security Audit or Bug Bounty
Security improvements are self-reported. No external verification. No financial incentive for researchers.
The Question That Matters
AutoGPT pioneered autonomous AI agents and made security mistakes that the entire industry learned from. The CVE history is a roadmap of what not to do: don't use denylists, don't assume any command is "safe," don't expose shell execution to user input. The team is now taking security seriously — but the architecture predates that awareness. The GitHub SOSF program helped, but you can't easily refactor away the assumption that some commands don't need human approval. AutoGPT is getting better. The question is whether it started from a place that's fixable.
Would I Deploy This in Production?
NO
AutoGPT's security improvements are real, but the CVE history shows fundamental design problems. The denylist approach is inherently bypassable. "Safe" command pre-approval defeats human-in-the-loop safety. Use this to learn about autonomous agents, not to deploy them in production. The 181K stars represent enthusiasm, not endorsement of its security posture.