Archon’s agent API has no auth: a critical 9.8 RCE, no fix yet
Versions 0.2.13–0.11.1 let anyone on the network run commands as you — the latest in a run of trust-boundary failures in self-hosted AI agents.
Copy markdown
A network request is all it takes
CVE-2026-111322 (CVSS 9.8) hits coleam00's Archon: the /api/* control plane ships with no authentication and binds to 0.0.0.0 by default. Reach the port and you can hand the coding agent a message that runs as shell commands on the host, since it executes with bypassPermissions.
No patch at disclosure — rebind to localhost now
The advisory went live Oct 15 with no fixed version named and NVD analysis still pending. Until a patch ships, firewall the API or bind it to 127.0.0.1 instead of 0.0.0.0, and treat any Archon you've exposed on a shared network or cloud box as already reachable.
Same bug, different agent framework
This is the second unauthenticated hit on Archon this year, after the web-to-client CVE-2025-69443, and agno's AgentOS shipped the identical default-no-auth REST flaw. Audit every self-hosted agent with shell access for a management port left open on 0.0.0.0 — it's becoming the category's signature mistake.
Your agent trusts the headers too
Resurfacing on Hacker News today: a study of 217M web responses found nearly half of validated indirect prompt injections rode in HTTP response headers, not the visible page body. If your agent fetches URLs, strip and sanitize headers — reading only the rendered text leaves the easier channel wide open.