Public AI agent scan brief
openai/openai-agents-python AI agent security scan
Partial no-execution triage for the public openai-agents-python repo. This is a heuristic scan of 90 selected public text files, not a commissioned audit, vulnerability disclosure, or security certification. These are not confirmed vulnerabilities.
Top findings
Multi-agent workflows need MCP, sandbox, and token boundaries
The scan snapshot saw 27,266 stars and review signals around MCP sessions, exposed ports, sandbox helpers, and credential paths with some redaction evidence. A paid review would validate hosted defaults, session isolation, local tool exposure, and regression coverage.
Evidence slice
Files that triggered review signals
Remote and MCP session signals appeared around `examples/mcp/manager_example/smoke_test.py`, `tests/mcp/test_mcp_auth_params.py`, `tests/mcp/test_mcp_resources.py`, `tests/mcp/test_streamable_http_session_id.py`, and `tests/sandbox/test_exposed_ports.py`.
Write and sandbox signals appeared near `_apply_patch_test_session.py`, runtime helpers, snapshot defaults, tar utilities, Unix-local sandbox tests, and MCP helper test paths.
Paid handoff
Convert this scan into a fixed-scope review
- Confirm the current multi-agent, MCP, sandbox, and tool surfaces in scope.
- Review remote listener policy, session isolation, filesystem writes, and auth parameters.
- Validate redaction, exposed-port behavior, cache handling, and lifecycle tests.
- Pay USD $1,000 only after written scope acceptance.