BartsAI BartsAI
中
Menu

AutoGPT

autogpt-v0.5.1 (commit 26324f2)
Constrained Evaluation

Classic autonomous agent for iterative goal pursuit with human-controlled execution modes.

Category: autonomous-general
License: MIT (AutoGPT Classic scope)
Reviewed: October 1, 2026
Revalidate by: December 30, 2026
Evidence: Levels B, C
⚠️ Specific Version Architectural Scope Notice

This evaluation reflects architectural observation and engineering analysis conducted strictly against AutoGPT autogpt-v0.5.1 (commit 26324f2) based on its default framework mechanics. It does not represent an ongoing certification of current upstream releases or an empirical benchmark of your specific deployment. Operational safety in production depends strictly on your implementation of external sandboxes, network egress boundaries, and state constraints.

Review protocol v1.1; revalidate by December 30, 2026. Disclosure status: not applicable — no private vulnerability report opened for these public architecture observations.

Evidence levels: A = reproducible observation; B = version-linked documentation or source; C = insufficient or out-of-scope evidence.

Deployment Evidence & Observation Scope

Default one-command authorization, workspace restriction, and disabled host shell execution provide useful boundaries; continuous mode, browser content, plugins, credentials, and external side effects still require deployment controls.

5-Dimension Architecture & Control Boundaries

1. Permission & Sandbox Safety Verified Control

Local file access is restricted to the workspace by default and host shell commands are disabled unless explicitly enabled. Plugins and other commands still require independent permission review.

2. Blast Radius & Failure Containment Verified Control

The default interaction budget authorizes one command before returning to the user. Continuous mode is explicit and becomes unbounded when enabled without a positive limit.

3. Data Boundaries & Anti-Injection Deployment Dependency

Web and plugin content enters the agent context; the reviewed source does not establish default semantic separation between untrusted content and subsequent command selection.

4. State Idempotency & Rollback Deployment Dependency

Agent state and workspace files can be retained, but arbitrary web, API, or plugin side effects are not transactionally replayed or rolled back.

5. Operational Observability Deployment Dependency

Local cycle and action history is recorded, but centralized retention, redaction, access control, and production telemetry are not established by the default configuration.

Recommended Enterprise Guardrails & Pre-Deployment Controls

  • Keep continuous mode disabled or set a positive command limit with time and cost ceilings
  • Retain workspace restriction and keep host shell execution disabled unless an isolated task requires it
  • Run browser, plugin, and code capabilities in disposable environments with default-deny egress
  • Use scoped credentials and require independent review before consequential external writes

Overview

AutoGPT Classic 0.5.1 iteratively proposes commands to pursue an open-ended task. Contrary to an unbounded-by-default description, the reviewed configuration requests authorization after one command, restricts local file access to an agent workspace, and disables local shell execution unless explicitly enabled. Operators can deliberately relax each of these boundaries, so deployment configuration remains decisive.

Scope of Review & Version Baseline

  • Repository: Significant-Gravitas/AutoGPT.
  • Reviewed Version: autogpt-v0.5.1 (Commit 26324f2).
  • License Boundary: This profile covers the MIT-licensed AutoGPT Classic scope represented by the tagged autogpts/autogpt code, not the separately licensed platform product.
  • Target Execution Model: Interactive Classic agent with optional continuous mode, browser commands, plugins, workspace file operations, and optional code or shell execution.
  • Primary Evidence Sources: Tagged configuration defaults, interaction loop, command execution, and workspace commands.
  • Out of Scope: Runtime exploit testing, AutoGPT Platform, later platform Beta releases, third-party plugins, and a specific enterprise deployment.

Observed Controls & Code Evidence

  1. Human Authorization by Default: The interaction loop assigns a one-command cycle budget when continuous mode is off. The agent proposes the next command and returns to the user for authorization before another command cycle.
  2. Explicit Continuous-Mode Risk: Continuous mode must be enabled. A positive continuous_limit bounds autonomous commands; a zero limit maps to an infinite cycle budget. The CLI surfaces a legal warning when continuous mode is active.
  3. Workspace and Shell Defaults: restrict_to_workspace defaults to true, while execute_local_commands defaults to false. If host shell execution is enabled, its default denylist only blocks sudo and su, so isolation cannot rely on that list alone.
  4. Containerized Python Execution When Available: Python code execution uses Docker with the agent workspace mounted when Docker is available. This is a code-execution mechanism, not a complete boundary for browser, plugin, credential, or external API actions.

Unverified Assumptions & Deployment Dependencies

  1. Untrusted Web and Plugin Content: Browser results and plugin output can influence subsequent command selection. No deterministic injection fixture was run, so this profile neither claims resistance nor labels an exploit as observed.
  2. Credential and Egress Boundaries: Model, search, plugin, and service credentials remain available according to deployment configuration. Network restrictions and credential brokers are external controls.
  3. External Recovery: Saved agent state and local logs support investigation, but they do not undo emails, API calls, downloads, or other completed external effects.

Deployment Evidence & Observation Summary

AutoGPT Classic 0.5.1 defaults to interactive command authorization, workspace-scoped files, and disabled host shell execution. Its risk increases materially when continuous mode, browser access, plugins, credentials, or mutable integrations are enabled without independent quotas, isolation, and review.

Notice: This source-based profile covers the AutoGPT Classic autogpt-v0.5.1 tag only. It does not assess the separately evolving AutoGPT Platform, reproduce an exploit, or approve a production deployment.

Deploying AutoGPT in your enterprise stack?

Generic evaluations can only evaluate default configurations. BartsAI provides custom Launch Gate reviews assessing your specific tool permissions, private database connections, and corporate release thresholds.

Request Custom Launch Gate Review Try the Architecture Self-Assessment →