Developer audits own coding agent after CVE exposes localhost shell vulnerability

A developer who maintains agentproto, a local daemon that lets AI agents run commands and access files on a user's machine, conducted a security audit after a researcher published a teardown of a similar tool called opencode. The opencode teardown revealed a critical CVE: a default HTTP server with permissive CORS settings and an endpoint that allowed any visited website to execute arbitrary shell commands on the host machine. The auditor found comparable weaknesses in agentproto, including a loopback authentication bypass that browser fetch requests could exploit, cross-origin-readable transcripts and event streams, and missing Host header validation against DNS rebinding attacks. The core fixes applied were an Origin header check to distinguish legitimate local clients from browser-based drive-by requests, and extending that gate to all data-reading routes, not just command endpoints. The author argues that string-based command filtering is ineffective and that real security requires OS-level process restrictions and strict control over which network origins can communicate with local agent daemons.