Critical: An Agent Framework Ships With Authentication Switched Off, and Turning It On Isn't Enough
GHSA-v2f8-6655-7grj lists five findings in one agent framework: an unauthenticated API by default, a read-side gap that survives setting a key, unauthenticated script writes, and permissive cross-origin access. The deeper problem is cultural.



















