AgentGPT 1.0.0 contains an authorization bypass that allows any authenticated user to create tasks for another user's agent run by providing a target run_id in the request body. The internal functions that create a task and enforce the per‑run loop budget do not verify that the supplied run_id belongs to the requester, enabling an attacker with valid credentials and knowledge of a run_id to corrupt task history, exhaust the run’s loop budget, and force the victim’s account to incur additional large language model usage costs. This flaw is classified as CWE‑639.

The affected product is reworkd:AgentGPT, all releases up through version 1.0.0. The vulnerability is present in every deployment of 1.0.0 or earlier; newer releases are assumed remedied unless proven otherwise.

The CVSS score of 2.3 signals low severity while the EPSS score of less than 1% indicates that exploit attempts are expected to be rare. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated API call that includes a target run_id in the request body; the attacker merely needs valid credentials and knowledge of a valid run_id to abuse the endpoint.