Agent Zero

On 13 October 2026, A0 CLI v2.14 separated concurrent chats’ shell state while retaining the same host filesystem, OS user and grants. Agent Zero’s internal browser still shares its sign-in profile across chats. Use separate Agent Zero instances for groups whose browser sign-ins must stay separate.

Where it stands, 2026-10-13

Install the stable image; update host companions separately. Install framework v2.14 from Docker image agent0ai/agent-zero:v2.14, with volume a0_usr mounted at /a0/usr. For host access, update the CLI to v2.14 with a0 update (which resolves the latest published release) and download Launcher v1.9 for your operating system.

Before upgrading an existing Agent Zero instance. Preserve local plugin patches: the updater rebases local commits, and user plugin files take precedence over bundled assets and extensions. Set local-provider keys or keyless mode before restarting. Allow network access and a possible restart for v2.14’s conditional dependency migration.

Re-test authenticated parallel calls before resuming dependent jobs. An issue report described unresolved secret aliases and authentication failures in parallel calls. A worker could retain unresolved secret aliases in its copied tool arguments. The retained fix lets secret substitution reach the worker’s arguments in v2.14. Test an authenticated parallel call without logging credentials.

Only admit bot users you would trust as administrators. Messaging administration reached stable in v2.13 on 23 September 2026. Telegram and WhatsApp users can toggle instance-wide plugins and edit non-Default profile permissions outside active runs. Edits persist in the active project’s profile scope, or globally without a project.

Set explicit numeric Telegram allowed_users and WhatsApp allowed_numbers for configured bots: Telegram’s empty list allows every user, and WhatsApp’s empty list skips sender filtering. Telegram can also select any instance chat. After messaging use, inspect plugin toggles and saved permissions.

Require login and narrow mounts before exposing the WebUI. Login checks are bypassed when no credentials hash exists. Configure both AUTH_LOGIN and AUTH_PASSWORD. The file browser is rooted at /, covering the container filesystem and mounts subject to process permissions. Connected host folders appear under live connector grants. Limit WebUI access to people you would let access those files.

Choose host grants and a narrow launch directory before connecting an editor. The editor connection defaults to permission to read and write host files and execute commands; those grants apply on the editor/CLI connection. The interactive CLI defaults exec and Computer Use off. The CLI checks host file paths against its launch root using realpath/commonpath. Host Computer Use remains beta, enabled for a whole CLI session or Launcher lease.

Deny both execution and input tools when commands are forbidden. Input sent to an idle host shell executes as a command, under existing host exec/write grants. With default allow, policy checks each canonical tool ID independently. Block both plugin:_a0_connector:code_execution_remote and plugin:_a0_connector:input_remote, and check the local execution/input pair. Or default Tools to block and allow deliberately. Verify denial through a subagent. Also migrate remote runtime=input callers to input_remote; the old path was removed.

Restrict backup access as you would credential access. Defaults include hidden user state, and host screenshots persist as chat media. New patterns exclude Orchestrator data and Time Travel history, but saved custom patterns are not rewritten. Inspect actual exclusions and who can read the archives.

Choose where the child runs before delegating. Orchestrator’s Codex example passes --dangerously-bypass-approvals-and-sandbox, and its non-root Claude Code example passes --permission-mode bypassPermissions. It supplies adapters and guidance. Check which child CLIs are installed and read the actual invocation. Choose the host or container scope with those bypasses in mind.

Stop one child without cancelling the parent. In v2.14, direct subagents show Working/Paused status; stopping a child returns a recoverable error to its parent, while parent cancellation kills the child. Test both cancellation paths on a bounded task. The human still decides which jobs receive host and account access.

What is unresolved

• Host shell and file boundaries: test the chat-keyed shell manager in two chats for independent directory, variables, input/output and resets. Test the host-file boundary with read and write attempts outside the launch root, including path changes. Follow with checks after grant revocation and on stale connections.

• Bot admission and saved policy: run /permissions with allowed and denied identities for an idle non-Default profile, then inspect the saved project/profile policy. Check menu access for the allowed identity, silence for the denied identity, and whether saved policy matches the allowed edits.

• Released recovery and profile switching: the remaining ready changes, including the incomplete-native-call guard and mid-run profile switching, are branch-only. A later stable tag retaining the truncation detection/guard and profile-switching code would settle release status. Before assuming a ready Docker image contains that head, require a record tying its digest to source.

• Installed dependencies: compare an inventory tied to the installed image digest with the tagged pins and floors to see which versions are installed.