What happened
CVE-2026-65699 (CVSS 4.2, published July 23 2026) documents an authorization-bypass-through-user-controlled-key vulnerability in AgentGPT allowing cross-user task injection.
Why it matters
Similar in class to the Suna finding but lower severity/impact, this allows authenticated users to inject tasks into another user's autonomous agent run, undermining tenant isolation in a popular open-source autonomous-agent framework.
Attack vector
AgentCRUD.create_task and validate_task_creation lack ownership verification on the supplied run_id, allowing authenticated attackers to attach arbitrary tasks to another user's agent run by simply specifying a target run_id in the request body.
Affected systems
AgentGPT through 1.0.0
Mitigation
Upgrade AgentGPT or apply ownership validation on run_id in task-creation endpoints once a fix is released; monitor NVD/vendor advisory for patched version.