Agent S

Agent S runs with the full authority of the logged-in user and narrows nothing. The model's chosen action is evaluated as raw Python inside the agent process, so it can reach every file, environment variable (including the model API keys), browser session and network destination the user can. The worker prompt even hands the model a sudo password and the generated typing code runs sudo, so a hijacked agent is the user, and possibly root on a machine that reuses that benchmark password.

There is no human approval anywhere. The CLI contains a permission-dialog function and a comment saying it asks for permission, but the function is never called, and the next line executes the model's action directly. Every click, keystroke, file operation or command the model chooses runs immediately, including irreversible ones such as sending email or deleting files through the GUI.

The agent advertises a small set of GUI actions (click, type, hotkey, open, scroll), but that set is not enforced. The model's reply is evaluated as Python, and the only check is a regular expression that the text contains exactly one call starting with 'agent.', which any payload can satisfy by nesting code inside the arguments. The action builders also paste arguments into code strings without escaping. In practice the tool surface is arbitrary Python on the user's machine.

Model output is executed twice inside the agent's own Python process: eval() turns the model's text into an action string, then exec() runs that string. There is no sandbox, container, separate user or restricted interpreter on either step, and the optional code agent also runs bash and Python directly on the host. The README advises running untrusted tasks in a sandbox, but the code provides none, so any escape lands in a process holding the API keys and the user's full desktop.

The agent reads whatever is on screen, including web pages, emails and documents written by others, and sends it straight to the model alongside the user's task. Nothing marks this content as untrusted or limits what the model may do after seeing it. Because the next action is arbitrary Python run without approval, a page that hijacks the model can make it exfiltrate files and keys over the network and take irreversible actions, all unattended.

The S3 agent keeps no memory between runs and auto-loads no workspace files. Its 'procedural memory' is a set of static prompts in the package, its text buffer lives only in process memory, and its log files are never read back. There is therefore no persistent path for poisoned content to shape future sessions through the agent itself, although arbitrary code execution (scored under code execution) can of course modify the user's files.

Agent S has no plugin or MCP system, but its type action generates code that, when the pyperclip package is missing, installs it from PyPI at runtime (unpinned) and runs apt-get under sudo using a hardcoded benchmark password. Because pyperclip is not a declared dependency, this fires on a fresh install the first time the agent types, without asking, and the freshly installed package is imported into the agent's own process.

API keys are read from environment variables or passed as command-line arguments, where they show up in process listings, and nothing anywhere masks or redacts secrets. The CLI turns on debug-level logging to a logs folder in the current directory and records every model plan plus the code agent's full code and output. Full-screen screenshots, which can show passwords or private messages, go to the model provider unfiltered. Secret handling in a bundled integration wrapper is not locked down.

The CLI writes timestamped text logs that include each model plan (which contains the chosen action call) and, when enabled, the code agent's commands and outputs. However, the actual code that gets executed is only printed to the terminal, not logged, results are not recorded per action, and screenshots are not saved, so a run cannot be fully reconstructed. Logs go to a folder in the current directory where the agent's own code can modify or delete them.

The CLI stops after 15 steps per task, a hardcoded loop bound, but has no time or spend limit. The step bound is in the CLI loop only; the AgentS3 SDK class has none. Model-chosen actions run without timeouts, the wait action sleeps for whatever duration the model picks, and the opt-in code agent gets a fresh 20-step budget on every call, with no timeout on its Python runs. Ctrl+C pauses and a second Ctrl+C exits the CLI, but processes started by evaluated code can outlive it.