Finding / agent-zero

2026-10-13-agent-zero-framework-v2-14-cli-v2-14-and-launcher-v1-9-are-the-stable-install-set

Framework v2.14, CLI v2.14 and Launcher v1.9 are the stable install set. The harvest missed the final day’s stable releases. The dated framework image is agent0ai/agent-zero:v2.14, observed digest sha256:b0c9763df7b8c4c5ddbdac9c101e8f84de8b7cdf9185203e446e2d7d8ebf2f1c; latest matched that digest when checked. CLI uses the official repository installer/a0 update; Launcher provides AppImage, DMG and EXE assets. No new npm/PyPI distribution route was established. Current defaults still distinguish interactive CLI exec/Computer Use off from ACP connection host read-write and exec on. ACP requires an editor/CLI connection. WebUI host-file access spans connected CLIs, checks live grants per operation, and writes require write_enabled; the CLI confines paths to its launch root by realpath/commonpath. The document-query public-address validation still exists at the inspected fetch call site.

Channel: tagged-release. Half: both. Date: 2026-10-13.

Operator consequence: Use the pinned v2.14 image and upgrade both host companions. Choose a narrow CLI launch directory, inspect ACP host grants before connecting an editor, and limit who can use the WebUI credentials. Do not describe an enabled ACP plugin as proof of a public unauthenticated service. Treat source checks as posture, with live grant/containment and SSRF testing still outstanding.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-agent-zero-framework-v2-14-cli-v2-14-and-launcher-v1-9-are-the-stable-install-set

Profile citations

Source links

Primary links, including exact changelog lines when available.