Executive brief
AutoGPT is an automation platform used to create and manage autonomous AI agents. A security vulnerability in the platform's backend allows for the execution of unauthorized commands if an attacker can manipulate the data stored in the system's Redis cache. This could lead to a total compromise of the backend server, potentially exposing sensitive data or disrupting AI agent operations.
Technical details
The AutoGPT Platform backend (specifically in `autogpt_platform/backend/backend/util/cache.py`) utilizes the Python `pickle` module to serialize and deserialize data stored in a Redis cache. The implementation lacks integrity checks, such as HMAC signatures or strict schema validation, when reading from the cache. An attacker who gains the ability to poison Redis cache keys—requiring adjacent network access and high privileges—can inject a malicious pickle payload. Upon deserialization via `pickle.loads()`, this payload triggers arbitrary command execution within the context of the backend container. The issue is addressed in version 0.6.52 by moving away from unsafe deserialization.
Affected products
- Significant-Gravitas AutoGPT Platform Backend 0.6.34 through 0.6.51
Timeline
- 2026-03-20: patched: Version 0.6.52 released
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: CVE published to NVD