Finding / agent-zero
2026-09-21-agent-zero-carry-forward-acp-defaults-unchanged-at-v2-11-and-v2-12-ssrf-tests-intact-blob-changed-for
Carry-forward: ACP defaults unchanged at v2.11 and v2.12; SSRF tests intact (blob changed for prompt text only). Nothing on either axis. ACP still ships always on, with host write and host exec on by default. The SSRF guard code has not changed since v2.10. The test file changed, but not the SSRF tests.
Channel: tagged-release. Half: defect. Date: 2026-09-09 (newest tag read).
Operator consequence: The parent advice stands for v2.12. Turn ACP off unless you want an editor-hosted endpoint with host write and exec. A tool that pins by blob hash will flag the test file. Those are prompt-assertion edits, not lost coverage.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-agent-zero-carry-forward-acp-defaults-unchanged-at-v2-11-and-v2-12-ssrf-tests-intact-blob-changed-for
Profile citations
- Agent Zero / claim / acp-defaults-unchanged
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-09-21-agent-zero-carry-forward-acp-defaults-unchanged-at-v2-11-and-v2-12-ssrf-tests-intact-blob-changed-foragent0ai/agent-zero / plugins/_a0_acp/default_config.yamltagged commit file2026-09-21-agent-zero-carry-forward-acp-defaults-unchanged-at-v2-11-and-v2-12-ssrf-tests-intact-blob-changed-foragent0ai/agent-zero / tests/test_document_query_plugin.py