Evidence record / agent-zero

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-agent-zero-framework-v2-14-cli-v2-14-and-launcher-v1-9-are-the-stable-install-set

Framework v2.14, CLI v2.14 and Launcher v1.9 are the stable install set. The harvest missed the final day’s stable releases. The dated framework image is agent0ai/agent-zero:v2.14, observed digest sha256:b0c9763df7b8c4c5ddbdac9c101e8f84de8b7cdf9185203e446e2d7d8ebf2f1c; latest matched that digest when checked. CLI uses the official repository installer/a0 update; Launcher provides AppImage, DMG and EXE assets. No new npm/PyPI distribution route was established. Current defaults still distinguish interactive CLI exec/Computer Use off from ACP connection host read-write and exec on. ACP requires an editor/CLI connection. WebUI host-file access spans connected CLIs, checks live grants per operation, and writes require write_enabled; the CLI confines paths to its launch root by realpath/commonpath. The document-query public-address validation still exists at the inspected fetch call site.

Channel: tagged-release. Half: both. Date: 2026-10-13.

Operator consequence: Use the pinned v2.14 image and upgrade both host companions. Choose a narrow CLI launch directory, inspect ACP host grants before connecting an editor, and limit who can use the WebUI credentials. Do not describe an enabled ACP plugin as proof of a public unauthenticated service. Treat source checks as posture, with live grant/containment and SSRF testing still outstanding.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-agent-zero-framework-v2-14-cli-v2-14-and-launcher-v1-9-are-the-stable-install-set

Profile citations

Source links

Primary links, including exact changelog lines when available.

Versioned source: run artifact