Executive brief
Archon, an open-source AI harness builder used for managing AI coding agents and workflows, contains a critical security flaw. A malicious website can bypass security boundaries to communicate with the Archon backend running on a user's machine. This allows an attacker to steal sensitive API keys (such as those for OpenAI or Google), execute arbitrary commands, and take full control of the AI agents, potentially leading to data theft and unauthorized financial charges on AI service accounts.
Technical details
Archon exposes two local ports: 3737 for the UI and 8181 for the backend. While the UI port implements CORS protections, the backend port (8181) lacks both CORS restrictions and authentication. This allows a malicious web page to perform a 'web-to-client' attack, where a victim's browser is used to send unauthenticated requests to the local backend. Attackers can exploit this to retrieve sensitive environment variables including API keys for LLM providers, manipulate UI features, and achieve remote code execution by invoking unprotected API calls. As of the advisory date, no official patch has been released.
Affected products
- coleam00 Archon 0.1.0 through 0.3.11
Timeline
- 2025-11-24: other: Initial outreach to maintainers via GitHub
- 2026-05-12: advisory: Public disclosure by OX Security
- 2026-05-14: disclosed: CVE published to NVD