npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Summary
The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware.
When a developer starts AgentOS, a network attacker who can reach the service can:
- read configured agent names, roles, and the first 100 characters of each agent's instructions through
GET /api/agents; and - invoke the selected agent through
POST /api/chat without credentials.
This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affected package here is npm:praisonai; the current published npm package is 1.7.1, and the same TypeScript source is still present in refreshed origin/main at v4.6.58.
Technical Details
AgentOSConfig exposes host, CORS, and API-prefix settings but no authentication token, auth mode, or authorization callback.
Relevant current-head source:
```text
src/praisonai-ts/src/os/config.ts
26: host?: string; // default: "0.0.0.0"
35: corsOrigins?: string[]; // default: ["*"]
66: export const DEFAULT_AGENTOS_CONFIG = {
68: host: '0.0.0.0',
71: corsOrigins: ['*'],
```
AgentOS._createApp() registers JSON parsing and CORS handling, then immediately registers routes. There is no middleware between body parsing and route registration that validates an API key, bearer token, session, origin-bound secret, or any other credential.
Relevant current-head source:
```text
src/praisonai-ts/src/os/agentos.ts
179: app.use(express.json());
182: // Add CORS middleware
204: // Register routes
205: this._registerRoutes(app);
```
The sensitive routes are then exposed:
```text
src/praisonai-ts/src/os/agentos.ts
235: app.get(${apiPrefix}/agents, ...)
240: instructions: agent.instructions ? ... : null
250: app.post(${apiPrefix}/chat, ...)
273: const response = await agent.chat(message);
331: const host = options.host || this.config.host;
338: this._server = app.listen(port, host, ...)
```
Because the default host is 0.0.0.0, await app.serve({ port: 8000 }) listens on all interfaces unless the developer explicitly overrides host.
Why This Is Not Intended Behavior
PraisonAI's official TypeScript documentation describes the npm package as a production-ready multi-agent framework and directs users to install it with npm install praisonai.
PraisonAI's security documentation says security reports should include affected versions, impact, reproduction steps, and a suggested fix, and states that GitHub Security Advisories are the preferred reporting method. The same security page also documents a prior hardening change where API servers were changed to require authentication by default and bind to 127.0.0.1 instead of 0.0.0.0.
The TypeScript npm AgentOS implementation still does the opposite:
- default bind address is
0.0.0.0; - no auth config exists in
AgentOSConfig; /api/agents discloses agent metadata and instruction prefixes; and/api/chat invokes agent.chat(message) directly.
The patched-control branch in the PoV confirms that adding a pre-route bearer-token middleware makes the same unauthenticated requests fail with 401.
PoV
The PoV installs the published npm package in a temporary project, starts AgentOS on 127.0.0.1 with a mock agent, and sends loopback HTTP requests. It does not call any LLM provider or external service after package installation.
Run from a local reproduction checkout:
```fish
node poc/pov_poc.js 1.7.1
```
Observed result:
```json
{
"version": "1.7.1",
"defaultHost": "0.0.0.0",
"agentsStatus": 200,
"agentsBody": {
"agents": [
{
"name": "finance-admin",
"role": "internal finance operations",
"instructions": "poc SECRET: refund-wire-tool may alter customer balances"
}
]
},
"chatStatus": 200,
"chatBody": {
"response": "agent-invoked:transfer-check",
"agent_name": "finance-admin"
},
"invokedMessages": [
"transfer-check"
]
}
```
No Authorization header is sent in the vulnerable requests.
The PoV also applies a minimal local-only auth middleware patch to the temporary installed copy and reruns the same requests as a control:
```json
{
"patchedNoAuthAgents": 401,
"patchedNoAuthChat": 401,
"patchedWithAuthAgents": 200,
"patchedWithAuthChat": 200
}
```
This control demonstrates that the PoV is exercising the missing authentication boundary, not an artifact of the mock agent.
PoC
The PoV section above contains the local reproduction command, input, and decisive output.
Impact
An attacker who can reach a running TypeScript AgentOS server can invoke configured agents without credentials. Real impact depends on the deployed agent, but PraisonAI agents may have access to tools, memory, workflow state, external APIs, credentials in process env
