The report
A CVE published on October 15 describes an authentication failure in Archon's coding-agent control API. The record lists versions 0.2.13 through 0.11.1 and says the /api/* interface binds to 0.0.0.0 by default. A client that can reach that interface can send tasks to an agent configured with bypassPermissions, with the potential to execute host commands as the Archon process user. These are the advisory's stated preconditions, not evidence that an internet-exposed server was exploited.
The dangerous transition is from network request to agent authority. An unauthenticated caller need not persuade the model to break its own rules if the control service directly accepts a task and passes it to a process with command-execution rights. This is why the Archon vulnerability dossier treats caller authentication and tool privileges as separate boundaries. A high CVSS rating describes the potential impact under assumed conditions, not observed victims.
Operators should establish whether the listener is reachable by untrusted clients, whether task dispatch is authenticated and whether the runtime uses broad execution permissions. Restricting network reachability reduces exposure but does not substitute for authenticated task authorization. The checked CVE record does not establish a fixed build; a verified vendor correction remains an open follow-up.
Source: published CVE record.