Self-hostable web app (Next.js + FastAPI) that runs an autonomous goal-driven agent loop in the browser with search, image, code-writing and Sid tools.
github.com/reworkd/agentgpt · 2026-10-04 · 18b073a
Defense-in-depth score
6.3 / 10
AgentGPT is mostly safe because it can do so little: it runs no code, writes nothing, and loads no plugins, so a hijacked run can't damage outside systems. The main risk is prompt injection from search results: nothing separates untrusted snippets from instructions. Output handling, authentication and secret management in the default install are also not locked down. The repository is archived and no longer maintained.
AgentGPT is safe mostly by design: it runs no code, writes nothing and loads no plugins. Elsewhere its defaults are weak: sign-in, secret handling and output rendering in the default install are not locked down, there are no per-user budgets, and the repository is archived, so these gaps won't be fixed upstream. The safest setup keeps it private and small and builds the boundaries around it.
| Setup | How | What it gives you |
|---|---|---|
| Dedicated, low-limit vendor keys | Give the backend OpenAI, Serper and Replicate keys used only by this install, each with a spending limit set at the provider | Whatever runs are started, spend and access stop at the limits the providers enforce C1 |
| Real sign-in, private network | Configure a real identity provider for sign-in and keep the app reachable only from your own network | Only people you know can reach the app and start runs C1 |
| Sid left unconfigured | Keep the default empty sid_client_id, sid_client_secret and sid_redirect_uri | Runs that read web content never hold users' private Notion, Drive or email data C5 |
| A lower loop cap | Set REWORKD_PLATFORM_MAX_LOOPS=<n>, 25 or lower, in the generated .env | Each run ends after a small, fixed number of steps C10 |
| Quieter backend logs | Set REWORKD_PLATFORM_LOG_LEVEL=WARNING in the backend .env | Search and summarization text stays out of the server's console output C8 |
| A per-user run limit | Put a reverse proxy in front of the backend that limits how many runs each user can start | Spend stays bounded across runs, not only within one C10 |
| Its own container, narrow egress | Run the backend in a container whose outbound access reaches only the model, search and image providers | A narrow path for data to leave the server, whatever a web page steers the model to do C5 |
0.50 / 1.00
Every backend agent request is tied to a logged-in user via a session token, and the optional Sid connector uses that user's own OAuth grant with minimal read-only scopes. The vendor keys the server uses (OpenAI, Serper, Replicate) are operator-wide account keys shared by every user, but the model can only use them through fixed, narrow API calls. Authentication in the default install and per-resource authorization are not locked down.
N/A · full credit 1.00 / 1.00
AgentGPT has no consequential actions. Its tools search Google through Serper, generate an image, query the user's Sid index read-only, or ask the model to write or reason in text. None of them write files, send messages, push code, or change state in an outside system, so there is nothing for an approval gate to protect. The tool set is fixed in code. Image generation does spend the operator's money, but that is bounded by the loop limits (scored under C10).
Strong 0.75 / 1.00
The tools are narrow by construction. Each one calls a single hard-coded endpoint (Serper, Replicate's pinned model or DALL-E, Sid), with fixed quantities (top 5 results, 10 Sid results, one 256x256 image), and the model only supplies a query string. There is no generic HTTP, shell, file or SQL tool. A central validator checks that the chosen action is a known tool name. Gaps: argument handling is not strict, and the per-task tool selection is not enforced on every path.
N/A · full credit 1.00 / 1.00
No model output is ever executed. The 'code' tool only asks the model to write code as text, which is shown to the user. The only eval-like call in the backend is Python's ast.literal_eval, which parses task lists and cannot run code. The setup CLI does spawn docker-compose, but the model cannot reach it.
0.05 / 1.00
Google search snippets go straight into the summarization prompt with no marking or separation, and each step's result is fed into the prompt that plans the next tasks. So a malicious web page can steer the rest of the run. Nothing in code limits what a hijacked run can do afterwards. Output rendering in the frontend is not locked down, which widens what a hijacked run can leak. No irreversible actions exist, which keeps this from being the worst case.
N/A · full credit 1.00 / 1.00
Nothing the model reads persists into later behaviour. The Pinecone memory module is present but never wired into the agent service. Saved runs are stored only for display and are not loaded back into prompts; the chat endpoint gets earlier results from the user's own browser. The backend's .env file is the service's own config, not a workspace the agent works on.
N/A · full credit 1.00 / 1.00
AgentGPT loads no third-party code at runtime: no plugins, no MCP servers, no downloaded tools or model files. Image generation calls Replicate's hosted API with a model version pinned by hash, and nothing is executed locally.
0.17 / 1.00
API keys come from environment variables and are never put into prompts. OAuth tokens for the Sid connector are encrypted at rest with Fernet, and errors from users' own API keys are kept out of the logs. But key management for that encryption is not locked down. Summarization text is logged at INFO level by default. The vendor keys are long-lived and cover the whole account.
0.42 / 1.00
Before each loop step runs, the backend writes a row recording the step type, linked to a run that stores the user and the goal. Because the row is written first, a database failure stops the step. But the record leaves out which tool ran, its arguments, and its result. The full conversation is saved only when the browser chooses to save it, so a run cannot be rebuilt from server-side records.
0.42 / 1.00
The server caps how many times each step type can run per run: 25 by default, but the setup CLI sets it to 100. Per-call output tokens are also capped per model. There is no wall-clock limit, no cost cap, and no per-user cap on how many runs can be started. Stopping is a flag in the browser that ends the loop and cancels the stream being read. Because the backend is stateless per request, nothing keeps running server-side after a stop.
SafetyCard