How do I secure AutoGen Studio?

Put AutoGen Studio behind an authenticating reverse proxy with TLS before binding to a public interface.

How many AutoGen Studio instances are exposed?

1 AutoGen Studio instances are reachable in the Shodan index (source: Shodan count · `http.html:"AutoGen Studio"`, 2026-08); that is a fingerprint match, not a verified zero-auth count.

← what I check

EXPOSURE AutoGen Studio
SEVERITY CRITICAL
PROBE GET :8000/api/version

CRITICAL

Is your AutoGen Studio exposed?

Multi-agent API open: teams, sessions and debugging reachable without auth.

Scan a host you own → Fix card Census

Why it matters

AutoGen Studio publishes multi-agent teams, sessions, and debugging over HTTP. Without auth, strangers can orchestrate agents against your models and tools.

How common is it?

1 AutoGen Studio instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.html:"AutoGen Studio"` · 2026-08

Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.

Fix it

The full walkthrough lives on the fix card, kept current in one place:

Full fix card: autogen-studio-exposed →