← fix library

CRITICAL

AutoGen Studio agent API exposed without authentication

Why it matters

AutoGen Studio publishes multi-agent teams, sessions, and debugging over HTTP. Without auth, strangers can orchestrate agents against your models and tools.

Fix it — 3 steps

  1. Put AutoGen Studio behind an authenticating reverse proxy with TLS before binding to a public interface.
  2. Bind to 127.0.0.1 for local-only use; do not publish /api/version or /api/health to the internet.
  3. Block the port at the firewall: sudo ufw deny <port>.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8080/api/version  # should not return 'AutoGen Studio API' to strangers

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack