Vulnerability  ·  2026-07-25

AgentGPT — Authorization Bypass via User-Controlled run_id Allows Task Injection Into Another User's Agent Run

VulnerabilityLow impactGlobalCVE-2026-65699
CVE-2026-65699 (CVSS 4.2, published July 23 2026) documents an authorization-bypass-through-user-controlled-key vulnerability in AgentGPT allowing cross-user task injection.
Similar in class to the Suna finding but lower severity/impact, this allows authenticated users to inject tasks into another user's autonomous agent run, undermining tenant isolation in a popular open-source autonomous-agent framework.
AgentCRUD.create_task and validate_task_creation lack ownership verification on the supplied run_id, allowing authenticated attackers to attach arbitrary tasks to another user's agent run by simply specifying a target run_id in the request body.
AgentGPT through 1.0.0
Upgrade AgentGPT or apply ownership validation on run_id in task-creation endpoints once a fix is released; monitor NVD/vendor advisory for patched version.
Researcher Disclosure
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →