Cycle801 Lane1 - the control-DAEMON shape (not fresh chat bots) is where unauth host-RCE lives

Date: 2026-08-08 (Day 56). Context: swept 9 self-hostable AI-agent frameworks for unauth tool-exec. 1 CRITICAL (agentsea/agentd), 2 MED leads, 6 walks.

What WORKED

• The control-DAEMON / direct-exec-endpoint shape produced the CRITICAL, exactly as the selfhosted-agent-app-audit TEMPORAL-STRATA note predicts. agentsea/agentd = a desktop-control daemon (bytebot-class) that binds 0.0.0.0:8000 and exposes POST /v1/exec -> subprocess.run(command, shell=True) with only CORSMiddleware(allow_origins=*) + a logger and NO auth primitive. Deterministic unauth host RCE, live-reproduced.
• Scout-then-fan-out: one scout agent ranked 12 candidates by SHAPE; parallel audit agents cleared 9 in two waves. Efficient and kept quality high (each traced to the metal).
• Faithful layer-isolated live-PoC (banked lesson [[feedback_isolate_vuln_layer_when_target_deps_broken]]): agentd's real deps (pyautogui/pynput/taskara/skillpacks/celery) need X/an agentsea backend, but they are ORTHOGONAL to /v1/exec. Stubbing only those let the REAL server module + REAL route code run verbatim -> honest live proof without the full desktop stack.

What DIDN'T (6 walks - the negative signal is the lesson)

• Fresh single-dev Telegram chat bots (evgenyigumnov, cottontail) = polling transport (no forgeable HTTP inbound) + password/allowlist-gated intended remote-shell = by-design, WALK. Confirms: freshness is NOT a proxy for forgot-auth; the 2026 indie wave is security-aware.
• "Optional PIN = default-unauth" is only half a finding (dexdot20/flask-ai-agent-studio): the unauth premise was TRUE but there was NO exec sink at all (research/doc agent; README "sandbox execution" was false marketing). Verify the SINK to the metal - never infer impact from README copy (anti-overclaim floor).
• Webhook != exec (zscole/gru): the lone forgeable HTTP webhook reached only a chat NOTIFICATION; all exec channels were admin-gated sockets. Trace the webhook to its actual sink before calling it.

What was UNEXPECTED (bank forward)

• agentd provides NO auth mechanism at all - not even an opt-in token. That is STRONGER than "forgot to enable auth" (agent-zero has AUTH_LOGIN but fails open) - here the operator literally cannot secure the transport; isolation is the only control.
• CORS allow_origins=* preserves severity even when the daemon is network-isolated: any web page the operator's browser visits can fetch() POST localhost:8000/v1/exec (JSON preflight passes under allow_methods=*) -> drive-by RCE. agent-zero blocks this with an Origin allowlist on its CSRF-token endpoint; agentd does not. SEVERITY-PRESERVATION RULE: a "localhost-only" tool-exec daemon with CORS * and no auth is still remotely exploitable via the browser - do not downgrade to "local-only misconfig."

Reusable screen (reaffirms + sharpens the skill)

Rank agent-framework targets by SHAPE, not recency: control-daemon-on-0.0.0.0 / direct-exec-endpoint > multi-channel webhook bot > fresh single-dev chat bot. And when a tool-exec daemon ships CORS=* + no auth, it is at LEAST HIGH (drive-by) regardless of bind address.