Secure Autonomous
FeedbackGet alertsCheck a deployment
Cases / REG-0032

Archon: control API (application programming interface), with its identity check off by default and open on all network interfaces, lets anyone who can reach it send instructions to an AI coding agent that runs without permission prompts; the CVE (Common Vulnerabilities and Exposures) record says this runs host commands, the reporter says that is not established; published 15 October 2026, no fix named

PendingSoftware agents · Enterprise work agentsMachine acts aloneDemonstration
REG-0032Updated 2026-10-225 sources, 5 linkedDisclosure corroborated

What happened

not evidenced in source. The AI coding agent run by Archon 0.2.13 through 0.11.1, which runs with bypassPermissions. Messages sent to the AI coding agent through the /api/* control API by an unauthenticated attacker with network access; the API binds to 0.0.0.0 by default. not evidenced in source. In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly. VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step'. Outcome: pending; none reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high; as of 21 Oct 2026. not evidenced in source.

Verification: 5 of 6 checks complete
✓ Structured and checkedevery claim typed and sourced, then checked by the Register's automated checker for missing sources and mistyped claims
✓ Sources linked5 of 5 sources link to the record (4 to a primary record)
✓ Sources checked claim by claimevery claim checked against its source on 2026-10-22
✓ Interpretation checked statement by statementeach statement of the Register's interpretation checked against a source on 2026-10-21
○ Reviewed by the editornot yet reviewed by a person
✓ Reply offeredArchon: offered
Corrections · 33, latest 2026-10-22

Changes to what this case says, with the reason. Every earlier version is kept.

  • 2026-10-22: Outcome: regime consequence. Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a cve, an advisory, a score or a fix is not one. the cve and fix details are already in the evidence and recovery fields, so nothing is lost. found while drafting this case's letters, 22 october 2026.
    Show the change
    Before: CVE-2026-111322; no fixed version named
    After: none
  • 2026-10-22: Fields: outcome. Follows the editor's call h1 of 21 october 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged.
    Show the change
    Before: State: averted by disclosure. No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026
    After: State: pending (no fix has shipped). No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026
  • 2026-10-21: Status text. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case.
    Show the change
    Before: Provisional (no maintainer advisory or fix in the sources; no exploitation reported)
    After: Confirmed (corroborated by Archon's own documentation and code; host command execution disputed; no fix; no exploitation reported)
  • 2026-10-21: Status. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed.
    Show the change
    Before: provisional
    After: confirmed
  • 2026-10-21: Provenance tier text. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): tier text updated to name the corroborating records.
    Show the change
    Before: CVE record assigned by VulnCheck and recorded in NVD; no maintainer advisory or fix found in the sources
    After: CVE record assigned by VulnCheck and recorded in NVD; corroborated by Archon's own security page and code, which show the identity check off by default and the agent running without per-action confirmation; host command execution is disputed by the reporter; no maintainer advisory or fix
  • 2026-10-21: Provenance tier. Editor's call h2 of 21 october 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism.
    Show the change
    Before: disclosure_uncorroborated
    After: disclosure_corroborated
  • 2026-10-21: Outcome: state. Editor's call h1 of 21 october 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened.
    Show the change
    Before: averted_by_disclosure
    After: pending
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the reporter's write-up separates the two: 'severity of a driven run depends on the workflows and agent configured'; with web authentication on the finding does not apply, while binding to the loopback interface 'removes the network reach even though the gate stays disabled' (hackmd).
    Show the change
    Before: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
    After: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established, that what a driven run does depends on the workflows and agent configured, and that turning on web authentication makes the finding not apply, while binding to the local machine only removes the network reach. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: abbreviation spelled out at first use.
    Show the change
    Before: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
    After: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: abbreviation spelled out at first use.
    Show the change
    Before: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
    After: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
  • 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: abbreviation spelled out at first use.
    Show the change
    Before: The records show an AI coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
    After: The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
  • 2026-10-21: Controls: c-e3. Found in the editor's source check of 21 october 2026: the note said the record 'does not describe what that mode bypasses'; archon's own security page (v0.11.1) does: 'without interactive confirmation prompts' and 'there is no per-action confirmation step'. the reporter's write-up shows the approve route (post /api/workflows/runs/{runid}/approve) is behind the same disabled gate. bucket and confidence unchanged.
    Show the change
    Before: Mechanism: the agent executes host commands from received messages while running with bypassPermissions. Why it interrupts: a confirmation step before command execution would put a human decision between the attacker's message and the command. Source shows it absent only by naming the bypassPermissions mode; the record does not describe what that mode bypasses or show the counterfactual
    After: Mechanism: the agent acts on received messages in bypassPermissions mode. Why it interrupts: a confirmation step before an action would put a human decision between the attacker's message and the action; no source shows this counterfactual, and the reporter notes that workflow approval gates, where a workflow has them, can themselves be approved by the same unauthenticated caller, so such a step would interrupt only if its approval were authenticated. Source shows it absent: Archon's security page says the agent can 'read, write, and execute files without interactive confirmation prompts' and 'There is no per-action confirmation step'; the CVE record names the bypassPermissions mode
  • 2026-10-21: Controls: c-a1. Found in the editor's source check of 21 october 2026: 'with no authentication' overstated: authentication is off by default, not missing (reporter's write-up quoting auth/config.ts and api.ts at v0.11.1); the counterfactual is now the reporter's own ('in that configuration the finding does not apply'). bucket and confidence unchanged.
    Show the change
    Before: Mechanism: the /api/* control API accepts messages for the coding agent from any caller with network access, with no authentication. Why it interrupts: if the API established the caller's identity by credential before passing a message to the agent, an unauthenticated attacker's instruction would never reach the agent. Source shows it absent: the record states missing authentication (CWE-306) on the control API
    After: Mechanism: in a default install the /api/* control API passes messages, workflow runs and approvals for the coding agent from any caller with network access without checking identity; the gate that would check is on only when DATABASE_URL and BETTER_AUTH_SECRET are both set. Why it interrupts: the reporter says that with that gate on, other routes return 401 (unauthorised) and 'In that configuration the finding does not apply'. Source shows it absent: the CVE record states missing authentication (CWE-306, Common Weakness Enumeration: Missing Authentication for Critical Function) on the control API, and the reporter quotes the code `if (!isApiGateEnabled()) return next();`
  • 2026-10-21: Inference: source ids. Found in the editor's source check of 21 october 2026: the interpretation now rests on the reporter's write-up, archon's security page and the v0.12.1 release as well as the nvd record.
    Show the change
    Before: ["NVD-111322"]
    After: ["NVD-111322", "HACKMD", "ARCHON-SEC", "ARCHON-0121"]
  • 2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: 'anyone who can reach the port holds the agent's command line' restated vulncheck's account, which the reporter's write-up disputes ('not established. this is not remote code execution on the host'), and 'no authentication on that channel' omitted that the gate is off by default rather than absent; the interpretation now states both accounts, the counterfactual the reporter makes ('in that configuration the finding does not apply'; loopback 'removes the network reach'), and what the record does not show. the interpretation was not signed, so no signature was cleared.
    Show the change
    Before: An agent allowed to run commands without asking is only as safe as the channel that gives it instructions: with no authentication on that channel, anyone who can reach the port holds the agent's command line
    After: The records show an AI coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026
  • 2026-10-21: Fields: recovery technical: source ids. Found in the editor's source check of 21 october 2026: added archon's changelog and source at tag v0.12.1.
    Show the change
    Before: ["NVD-111322", "CVE-111322"]
    After: ["NVD-111322", "CVE-111322", "ARCHON-0121"]
  • 2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: later development: archon released 0.12.0 and 0.12.1 on 17 october 2026. the changelog at v0.12.1 names no fix for this flaw (0.12.0 notes of a related change 'solo installs behave as before'); the source at that tag still has `process.env.host || '0.0.0.0'` and `if (!isapigateenabled()) return next();`; the security page at that tag adds 'the console with web auth off and no resolved identity is also the operator'. the cve record's range still ends at 0.11.1.
    Show the change
    Before: No fixed version is named in the records
    After: No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1
  • 2026-10-21: Fields: evidence event: source ids. Found in the editor's source check of 21 october 2026: added the reporter's write-up for its date and method.
    Show the change
    Before: ["NVD-111322", "CVE-111322"]
    After: ["NVD-111322", "CVE-111322", "HACKMD"]
  • 2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the case did not say who assigned the cvss scores (vulncheck; the nvd record lists them as 'secondary' from disclosure@vulncheck.com, status 'deferred'), that the finding came from source review only (write-up created 14 october 2026: 'runtime validation was not performed'), or that cisa rates exploitation 'poc'; abbreviations spelled out. dates, cwe-306, scores, range and finder unchanged and confirmed in the cve.org record.
    Show the change
    Before: CVE-2026-111322, assigned by VulnCheck (reserved and published 15 October 2026), CWE-306 Missing Authentication for Critical Function, CVSS 4.0 9.3 and CVSS 3.1 9.8; affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn
    After: CVE-2026-111322, assigned by VulnCheck as CVE Numbering Authority (reserved and published 15 October 2026); weakness CWE-306 (Common Weakness Enumeration: Missing Authentication for Critical Function); VulnCheck's severity scores CVSS (Common Vulnerability Scoring System) version 4.0 9.3 and version 3.1 9.8, which the National Vulnerability Database lists as VulnCheck's without scoring the record itself (status Deferred); affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn, whose write-up of 14 October 2026 reviewed the source at v0.11.1 and states 'Runtime validation was NOT performed'; the US Cybersecurity and Infrastructure Security Agency's enrichment of 16 October 2026 rates exploitation 'poc' (proof of concept)
  • 2026-10-21: Fields: outcome: source ids. Found in the editor's source check of 21 october 2026: added the reporter's write-up, which says no requests were sent.
    Show the change
    Before: ["NVD-111322", "CVE-111322"]
    After: ["NVD-111322", "CVE-111322", "HACKMD"]
  • 2026-10-21: Fields: outcome. Found in the editor's source check of 21 october 2026: the case did not say the flaw was never run or that cisa rates exploitation as proof of concept. the nvd record (api copy) carries cisa's ssvc (stakeholder-specific vulnerability categorization) entry of 16 october 2026: exploitation 'poc', automatable 'yes', technical impact 'total'; the cve.org record's cisa container tags the reporter's write-up 'exploit'; the write-up says its requests 'were not executed against a live instance'.
    Show the change
    Before: State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026
    After: State: averted by disclosure. No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026
  • 2026-10-21: Fields: action: source ids. Found in the editor's source check of 21 october 2026: added the reporter's write-up and archon's security page, which give the competing account and the agent's documented capability.
    Show the change
    Before: ["NVD-111322", "CVE-111322"]
    After: ["NVD-111322", "CVE-111322", "HACKMD", "ARCHON-SEC"]
  • 2026-10-21: Fields: action: disputed. Found in the editor's source check of 21 october 2026: the sources disagree. vulncheck's cve record: 'to execute commands on the host as the archon user'. the reporter's write-up, which that record cites: 'not established. this is not remote code execution on the host' and 'runtime validation was not performed'. archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'.
    Show the change
    Before: false
    After: true
  • 2026-10-21: Fields: action: confidence. Found in the editor's source check of 21 october 2026: the sources disagree. vulncheck's cve record: 'to execute commands on the host as the archon user'. the reporter's write-up, which that record cites: 'not established. this is not remote code execution on the host' and 'runtime validation was not performed'. archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; confidence lowered to medium.
    Show the change
    Before: high
    After: medium
  • 2026-10-21: Fields: action: assertion type. Found in the editor's source check of 21 october 2026: the sources disagree. vulncheck's cve record: 'to execute commands on the host as the archon user'. the reporter's write-up, which that record cites: 'not established. this is not remote code execution on the host' and 'runtime validation was not performed'. archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; a disputed claim stated by one source is an assertion, not a fact (downgraded, not upgraded).
    Show the change
    Before: fact
    After: assertion
  • 2026-10-21: Fields: action. Found in the editor's source check of 21 october 2026: the sources disagree. vulncheck's cve record: 'to execute commands on the host as the archon user'. the reporter's write-up, which that record cites: 'not established. this is not remote code execution on the host' and 'runtime validation was not performed'. archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; both accounts now stated and attributed.
    Show the change
    Before: The agent executes commands on the host as the Archon user
    After: VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step'
  • 2026-10-21: Fields: envelope constraints: source ids. Found in the editor's source check of 21 october 2026: added the reporter's write-up and archon's security page, which state the gate condition and the vendor's documented posture.
    Show the change
    Before: ["NVD-111322", "CVE-111322"]
    After: ["NVD-111322", "CVE-111322", "HACKMD", "ARCHON-SEC"]
  • 2026-10-21: Fields: envelope constraints. Found in the editor's source check of 21 october 2026: the api is not without authentication: its identity gate is off by default. the reporter quotes the code, `if (!isapigateenabled()) return next();` and iswebauthenabled requiring both database_url and better_auth_secret, and says a default sqlite install sets neither; archon's security page (v0.11.1) says bypasspermissions means 'there is no per-action confirmation step' and that sqlite and solo installs 'have no built-in user authentication', with basic or form authentication advised 'when exposing it publicly'.
    Show the change
    Before: The /api/* control API has no authentication and binds to 0.0.0.0 by default; the agent runs with bypassPermissions
    After: In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly
  • 2026-10-21: Outcome: as of. Found in the editor's source check of 21 october 2026: later developments checked to 21 october 2026: archon 0.12.0 and 0.12.1 released 17 october 2026 with no fix named (archon changelog.md at v0.12.1); cisa enrichment added to the cve record 16 october 2026.
    Show the change
    Before: Oct 2026
    After: 21 Oct 2026
  • 2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the nvd record (api copy) lists the cvss 4.0 and 3.1 scores with source disclosure@vulncheck.com, type 'secondary', vulnstatus 'deferred'; the cve.org record carries them in vulncheck's container; the reporter's write-up badge reads 'severity-high'. the case did not say who assigned the scores.
    Show the change
    Before: none reported (CVSS 4.0 9.3; CVSS 3.1 9.8)
    After: none reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high
  • 2026-10-21: Context: mandate context text. Found in the editor's source check of 21 october 2026: the reporter's write-up says 'the requests below are illustrative and were not executed against a live instance' and 'the finding is established by reading the pinned source at release tag v0.11.1'.
    Show the change
    Before: Vulnerability disclosure; no exploitation reported
    After: Vulnerability disclosure found by reading Archon's source code at v0.11.1; the reporter sent no requests to a running instance; no exploitation reported
  • 2026-10-21: Context: autonomy level text. Found in the editor's source check of 21 october 2026: that the agent 'executes commands on the host from messages received over the control api' is vulncheck's account, disputed by the reporter's write-up; archon's security page (v0.11.1) supports the capability: the agent 'can run shell commands' and 'there is no per-action confirmation step'.
    Show the change
    Before: The coding agent runs with bypassPermissions and executes commands on the host from messages received over the control API
    After: The coding agent runs in bypassPermissions mode, which Archon's security page says lets it read, write and execute files and run shell commands with no per-action confirmation step; it acts on messages received over the control API
  • 2026-10-21: Title. Found in the editor's source check of 21 october 2026: the api has an authentication gate that is off by default, not none (archon v0.11.1 auth/config.ts and api.ts as quoted in the reporter's write-up; archon's security page: web auth 'gates the api server-side' when enabled); and 'execute host commands' is vulncheck's account in the cve record, which the reporter's write-up disputes ('not established. this is not remote code execution on the host'). 'without permission prompts' is archon's own description of bypasspermissions ('without interactive confirmation prompts').
    Show the change
    Before: Archon: unauthenticated control API, bound to all interfaces by default, lets anyone on the network instruct an AI coding agent that runs with bypassPermissions to execute host commands; CVE published 15 October 2026, no fix named
    After: Archon: control API (application programming interface), with its identity check off by default and open on all network interfaces, lets anyone who can reach it send instructions to an AI coding agent that runs without permission prompts; the CVE (Common Vulnerabilities and Exposures) record says this runs host commands, the reporter says that is not established; published 15 October 2026, no fix named
Record history · 4 entries
  • 2026-10-22: Right of reply offered to Archon.
  • 2026-10-21: Source added: coleam00/Archon CHANGELOG.md at tag v0.12.1: releases 0.12.0 and 0.12.1 of 17 October 2026 (server source and security page read at the same tag).
  • 2026-10-21: Source added: Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1).
  • 2026-10-21: Source added: Archon OS control API has no authentication by default and binds to all interfaces.

Controls that address what went wrong

2 controls missing or failed. The line under each is the concrete form it would have taken in this case.

Actor identity verification
Absent: Mechanism: in a default install the /api/* control API passes messages, workflow runs and approvals for the coding agent from any caller with network access without checking identity. the gate that would check is on only when DATABASE_URL and BETTER_AUTH_SECRET are both set. Why it interrupts: the reporter says that with that gate on, other routes return 401 (unauthorised) and 'In that configuration the finding does not apply'. Source shows it absent: the CVE record states missing authentication (CWE-306, Common Weakness Enumeration: Missing Authentication for Critical Function) on the control API, and the reporter quotes the code `if (!isApiGateEnabled()) return next();`.
Absent · Actor layer
Destructive-action gate
Absent: Mechanism: the agent acts on received messages in bypassPermissions mode. Why it interrupts: a confirmation step before an action would put a human decision between the attacker's message and the action. no source shows this counterfactual, and the reporter notes that workflow approval gates, where a workflow has them, can themselves be approved by the same unauthenticated caller, so such a step would interrupt only if its approval were authenticated. Source shows it absent: Archon's security page says the agent can 'read, write, and execute files without interactive confirmation prompts' and 'There is no per-action confirmation step'. the CVE record names the bypassPermissions mode.
Absent · Envelope layer

New cases like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.

Get the weekly email

How it unfolded, layer by layer

MandateWhat it was told to do
Who deployed it: not evidenced in source. The task: not evidenced in source.
ActorWhat acted
The AI coding agent run by Archon 0.2.13 through 0.11.1, which runs with bypassPermissions
Absent: Actor identity verification
InputsWhat it could see
Messages sent to the AI coding agent through the /api/* control API by an unauthenticated attacker with network access; the API binds to 0.0.0.0 by default
DecisionHow it chose
not evidenced in source
EnvelopeWhat it was allowed to do
Limits in place: In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly.
Absent: Destructive-action gate
ActionWhat it did
VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step'
OutcomeWhat happened
Pending. Severity: none reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high.
EvidenceWhat can be proven
Record of the event: CVE-2026-111322, assigned by VulnCheck as CVE Numbering Authority (reserved and published 15 October 2026); weakness CWE-306 (Common Weakness Enumeration: Missing Authentication for Critical Function); VulnCheck's severity scores CVSS (Common Vulnerability Scoring System) version 4.0 9.3 and version 3.1 9.8, which the National Vulnerability Database lists as VulnCheck's without scoring the record itself (status Deferred); affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn, whose write-up of 14 October 2026 reviewed the source at v0.11.1 and states 'Runtime validation was NOT performed'; the US Cybersecurity and Infrastructure Security Agency's enrichment of 16 October 2026 rates exploitation 'poc' (proof of concept).
RecoveryWhat could be stopped, undone, answered for
Technical recovery: No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1. Accountability: not evidenced in source.

The same gap in other cases

Cases where the same control was missing or failed. Those in another world are the cross-domain comparisons the Register exists to make.

ControlSame worldOther worlds
Actor identity verificationAgent-run intrusion campaign 2025, Claude Code [bot] trust 2026, Pydantic AI: a web page can make a…, Model Context Protocol (MCP) TypeScript…, piflow: anyone who can reach the…Kia dealer portal 2024 (machines)
Destructive-action gatePocketOS 2026, Replit and SaaStr 2025, Pydantic AI: a web page can make a…, destructive_command_guard: a crafted…, OpenSRE: instructions planted in alerts or…, LangAlpha: instructions planted in web…, piflow: anyone who can reach the…, Vibe-Trading: instructions planted in…Triton 2017 (machines), Gemini calendar invite 2025 (software acting on machines), IntentKit: owner-only agent tools,… (agents moving money)

Cost and accountability

Severitynone reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high
AffectedNot recorded
Costnone reported
Regulatory or legal consequencenone
Technical recoveryTechnical recovery: No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1.
Accountabilitynot evidenced in source
InterpretationWhy it matters beyond its domain. The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established, that what a driven run does depends on the workflows and agent configured, and that turning on web authentication makes the finding not apply, while binding to the local machine only removes the network reach. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026. Signed by Saurabh Bhatnagar on 2026-10-21.

Right of reply

Named partyStatus
ArchonOffered 2026-10-22; awaiting responseRespond for Archon

Help shape the Register

A person reads every answer; changes it leads to are logged in the methodology. To dispute a claim or reply for a named company, use Respond, dispute, or submit.

Did this page help with what you came to do?