AutoAgent Critical Flaw: Root RCE via Unauthenticated TCP

CVE-2026-86124. CVSS 9.8. Unauthenticated root RCE in AutoAgent. Patch is available.

AutoAgent, an AI agent framework from HKUDS, ships a TCP server that binds to all network interfaces and accepts commands from any client with no authentication check. Commands run as root. Any system running AutoAgent with that TCP port exposed to an untrusted network is fully compromised without credentials.

Source: GitHub advisory. Exploitation status in the wild: unconfirmed as of this writing.

The pattern

This is not an isolated mistake. CVE-2026-86121, disclosed the same day, hits Cua computer-server with the same structure: unauthenticated TCP server, all interfaces, code execution. CVSS 9.8 on that one too. Different project, same failure mode.

AI agent frameworks are relatively new software. Many are built to be easy to run locally and fast to extend. That design trade-off has a consistent shadow: network services that skip authentication because the author assumed local use only. When those services ship bound to 0.0.0.0 by default, any exposed host is a target.

It is not a novel finding. It is a recurring one.

Who is affected

Installations of AutoAgent with the TCP server port reachable from untrusted hosts. Check firewall rules and cloud security group configurations. If the port is exposed, assume compromise is possible until the patch is applied.

Patch to the fixed version listed in the GitHub advisory. If patching immediately is not possible, block the TCP port at the network layer.

Related coverage

MindsDB’s CVSS 10 unauthenticated RCE and Metabase’s max-severity zero-day followed the same pattern: AI and analytics tooling with management services exposed and accessible without credentials.