AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
OpenHuman agent can be steered by external messages into persistent shell cron jobs
OpenHuman versions before 0.57.13 let anyone who can message a configured external channel make the agent create scheduled shell jobs without human approval. Upgrade to 0.57.13 and review existing cron jobs and channel integrations.
In plain terms
OpenHuman is an open-source AI agent harness, a framework that lets an AI agent carry out tasks on a computer. It ships as a desktop application and as a Rust library. It can be connected to external channels, such as messaging integrations, that send it instructions. In versions before 0.57.13, someone who can send messages to one of those channels can get the agent to set up cron jobs without a person approving them. Cron jobs are scheduled tasks that the system runs automatically. These jobs persist and later run shell commands with the same permissions as the account running OpenHuman.
The practical result is that an outsider could gain lasting, repeated command execution on the machine. Anything that account can reach, including files, credentials and connected services, could be exposed. Anyone running OpenHuman with an external channel configured should treat this as urgent.