agent-device flaw let remote callers read local files on host machines

GitHub Security Advisories disclosed a local file disclosure vulnerability in agent-device on November 13, 2026. agent-device is an open source CLI, MCP server and Node.js API that lets AI coding agents control mobile, web, TV and desktop apps on real devices and simulators, and the advisory states that an authenticated remote caller can exfiltrate arbitrary readable files from the host running it. Full details are in agent-device Local File Disclosure via file:// Navigation in Open Command.

What changed

• agent-device is described as an open source device layer for AI coding agents: a CLI, MCP server and typed Node.js API to control mobile, web, TV and desktop apps on devices and simulators.
• The advisory is tracked as GHSA-g87j-p64h-w8wc and CVE-2026-129130, classified as CWE-73 (External Control of File Name or Path).
• Affected versions are 0.21.36 and earlier; the fix shipped in version 0.21.37.
• CVSS severity is listed as 6.5 Medium by one tracker and 7.1 High by another.
• An authenticated remote caller can send an open command targeting a file:// URL through the /rpc interface.
• A follow-up snapshot command lets the attacker exfiltrate any plaintext file readable by the daemon's host account.

What it means for people who build with AI

The vulnerability sits inside an MCP server built specifically so AI coding agents can control real devices, which means a remote attacker can read arbitrary local files through the agent's own daemon. For teams adopting agentic device automation, that is a concrete supply chain risk: any workflow that exposes agent-device's /rpc interface to a remote caller could leak plaintext files readable by the account running the daemon.

Fix and availability

The fix shipped in version 0.21.37; versions 0.21.36 and earlier remain affected. Teams running agent-device as part of an agentic device automation pipeline should update to 0.21.37 to close the open command and snapshot command exploit path described in the advisory.

Sources

• agent-device Local File Disclosure via file:// Navigation in Open Command (GitHub Security Advisories, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.