AgentGPT Insecure Direct Object Reference on Agent Run Tasks (IDOR via run_id)

Technical Analysis

The vulnerability lies in AgentCRUD.create_task and validate_task_count, which look up an AgentRun by a client-supplied run_id in the request body but never check that the run's owning user matches the requesting user's session/identity. An authenticated attacker who obtains a valid run_id (via enumeration, leakage, or observation) can call the task-creation endpoint to append arbitrary tasks to that run, polluting the victim's agent execution state and consuming the run's finite task-loop budget. Because AgentGPT autonomously executes queued tasks against an LLM, this cross-tenant task injection translates directly into unauthorized LLM API consumption and denial-of-wallet/denial-of-service against the victim's session. The flaw crosses a trust boundary between application-level user authorization and the agent execution layer, where task queues are treated as trusted internal state rather than user-scoped resources.

Affected Systems

AgentGPT

Detection Signatures

• Log pattern: create_task or task-creation API calls where request run_id does not belong to the authenticated session's user_id
• Anomalous spike in tasks added to a given run_id from a session/IP inconsistent with the run's original creator
• Repeated validate_task_count calls approaching per-run task limits shortly after cross-user task creation events
• Unexpected LLM API cost spikes correlated with runs not recently created by the billed user

Remediation Steps

1. 1

   Enforce ownership checks

   Modify AgentCRUD.create_task and validate_task_count to verify the requesting user's identity matches the AgentRun's owner before performing any read or write operation, returning 403/404 on mismatch.

2. 2

   Use indirect or non-enumerable references

   Replace or supplement client-supplied run_id with server-side session-bound run resolution, or use unguessable, per-user-scoped identifiers with additional authorization tokens.

3. 3

   Rate-limit and budget per user, not just per run

   Apply task-count and LLM-cost budgets at the user/account level in addition to the per-run level so a single compromised run_id cannot be leveraged to exhaust unrelated victims' quotas.

4. 4

   Patch to fixed version

   Upgrade AgentGPT beyond version 1.0.0 once a patched release addressing this authorization bypass is available, and audit logs for historical exploitation.

5. 5

   Add object-level authorization tests

   Incorporate automated IDOR/BOLA test cases covering all agent-run and task endpoints into CI to catch similar missing ownership checks in future agent framework features.