What happened
PraisonAI's AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} without any access-control checks. A remotely exposed server lets unauthenticated clients list registered agents and invoke agent.chat directly, controlling an agent that has access to private context and tools. An attacker therefore gets full conversational control of a deployed AI agent team without credentials. Patched in 1.6.59.
Why it matters
This is unauthenticated remote control of a production multi-agent system. A compromised agent is a powerful primitive: it can exfiltrate conversation context, waste model/quota resources, and drive the agent's connected tools and workflows — the exact scenario that makes agentic infrastructure a high-value target.
Attack vector
Network — an attacker reaches the exposed Agents HTTP router (AgentTeam.launch) and calls the /{path}/list and /{path}/{agent_id} endpoints without authentication: enumerate agents, consume model resources, read connected private context, and trigger agent tools/workflow side effects.
Affected systems
PraisonAI / praisonaiagents < 1.6.59 (multi-agent teams framework)
Mitigation
Upgrade to praisonaiagents 1.6.59 / PraisonAI 4.6.59 (commit b4270173d4123fb1ee8910588f0896668ee21b59; GHSA-x8cv-xmq7-p8xp). Do not expose the agents server without an API key; place behind an authenticated gateway.