Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / agent-zero

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settings

Launcher v1.9 adds per-host certificate trust and preserves Windows settings. Launcher v1.9 lets a saved remote host opt into accepting unknown certificate issuers while retaining host-name and validity-date checks. The trust rule is host-specific, not blanket TLS disablement. Its Windows installer preserves settings around legacy uninstallers, failed installation and interrupted recovery; WSL/Docker discovery also changes. The Launcher lock moves js-yaml 4.2.0 to 4.3.2, above GHSA-5p4m-2wfm-xmqj’s affected 4.x range below 4.3.1: crafted ordered-map YAML can consume quadratic CPU and stall parsing. That advisory predates this window; the shipped update is new. CLI v2.14 pins multidict 6.9.1 and framework v2.14 adds that floor. CVE-2026-104874 affects multidict C-extension 6.7.0..6.9.0 items-view reflected unions/subtractions and can exhaust memory. No reachable attacker-controlled parser or items-view path through Agent Zero was demonstrated.

Channel: tagged-release. Half: both. Date: 2026-10-13 (stable companion releases).

Operator consequence: Review which saved hosts receive certificate trust and retain a settings backup before Windows upgrade. Use Launcher v1.9 and CLI v2.14 for these shipped changes. Check dependency resolution without claiming that dependency membership proves application-level exploitation or that these availability bugs disclose data.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settings

Source links

Primary links, including exact changelog lines when available.

  1. Agent Zero
    github release2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsagent0ai/a0-launcher / v1.9commit2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/agent0ai/a0-launcher/commit/dc72cb4a86d9f4b65f7e7d354f39e403f08dba5btagged commit file2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsagent0ai/a0-launcher / shell/remote_certificate_trust.jscommit2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/agent0ai/a0-launcher/commit/d6b465d1500626954cb3fc0109ebbe5bd9c52942commit2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/agent0ai/a0-launcher/commit/98e390f3849b4731566908867897aa9707a551dbofficial docs2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/advisories/GHSA-5p4m-2wfm-xmqjcommit2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/agent0ai/a0-connector/commit/7676c282069a291a95b310fa2554c9c936896dc8tagged commit file2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsagent0ai/a0-connector / constraints/a0-runtime.txtofficial docs2026-10-13-agent-zero-launcher-v1-9-adds-per-host-certificate-trust-and-preserves-windows-settingsgithub.com/advisories/GHSA-54p9-h82j-f925

Versioned source: run artifact