Week 45, updated 2 Nov 2026

Automation & agent frameworks AutoGPT

Is AutoGPT safe?

Short answer: Caution. StackGrade's weekly scan of Significant-Gravitas/AutoGPT gives it a Caution label for 16 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 211 high-severity advisories in runtime dependencies, which don't change the label. 1 phrase in agent instruction files was flagged for human review (unclear). Critical advisories are counted once per package; a known issue in a locked package version does not prove AutoGPT is exploitable in your setup. Automated scan of commit ef7f41c on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Platform for building and running autonomous AI agents.

  • 187,861 stars
  • pushed 2 Nov
  • MIT + Polyform Shield
  • Python

github.com/Significant-Gravitas/AutoGPT · agpt.co

62score out of 100

#14of 52 overall#2in Automation & agent frameworks▼ 2 vs Week 44

  • Maintenance 30%55
  • Adoption 30%91
  • Docs 20%29
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 61, 61, 64, 62.

Caution

16 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 65 days (about 4.2 per 30 days), latest release 1 Nov 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 187,861 stars (70%), 45,901 forks (30%).
  • Docs: README 9,502 characters, 11 headings, 2 code blocks, install section: yes.

Methodology

#2 of 14 in Automation & agent frameworks

Ranked by score. The yellow row is this tool.

Automation & agent frameworks, Week 45score 0–100, safety
  1. 1n8n#3 overall70Caution
  2. 2AutoGPT#14 overall62Caution
  3. 3CrewAI#18 overall57Caution
  4. 4Dify#20 overall56Caution
  5. 5LangChain#23 overall54Caution
  6. 6Pydantic AI#31 overall46Caution
Show the other 8
  1. 7Mastra#33 overall44No issues found
  2. 8LangGraph#34 overall44No issues found
  3. 9Agent Development Kit (ADK, Python)#36 overall43Caution
  4. 10OpenBot#39 overall41Caution
  5. 11AutoGen#41 overall40Caution
  6. 12OpenAI Agents SDK (Python)#42 overall39Caution
  7. 13smolagents#47 overall30No dependencies scanned
  8. 14artemis#50 overall25Caution

Safety scan, 2 Nov 2026

Automated scan of commit ef7f41c, 8,166 files. Not a manual audit.

Caution

  • 16Critical dependency advisories211 high, 176 medium, 34 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 285Agent files checked1 phrase flagged for review.
  • 2curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 16 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 16 critical, 211 high, 176 medium, 34 low, 1 unrated

  • certifi@2025.7.14 (PYSEC-2026-4320) in autogpt_platform/autogpt_libs/poetry.lock
  • black@24.10.0 (PYSEC-2026-2120) in autogpt_platform/backend/poetry.lock
  • @sentry/nextjs@10.27.0 (GHSA-mchm-gjx6-7h55) in autogpt_platform/frontend/pnpm-lock.yaml
  • better-auth@1.6.33 (GHSA-965c-763c-88jm) in autogpt_platform/frontend/pnpm-lock.yaml
  • shell-quote@1.9.0 (GHSA-pqg4-j6r4-53mv) in autogpt_platform/frontend/pnpm-lock.yaml

Also found (informational, does not change the label):

  • 1 injection-related phrase in instruction files, flagged for human review (often defensive guidance), e.g. .claude/skills/orchestrate/SKILL.md
  • 211 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Program code runs a curl|sh style installer (1 occurrence, e.g. autogpt_platform/installer/setup-autogpt.sh)
  • Documents curl|sh style installer (1 occurrence, e.g. autogpt_platform/backend/backend/copilot/gate/testdata/content_corpus.json)
  • Critical advisories counted once per package: 19 matches across 5 lockfiles
  • Skill scripts contact: us.sentry.io

Notes:

  • 10 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: posthog, sentry_sdk, amplitude, telemetry

Automated scan of commit ef7f41c on 2 Nov 2026, not a manual audit. 8,166 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest preview-seed-fixture, 1 Nov
  • –Median issue closeFewer than 5 closed issues
  • 188kStars+110 since 26 Oct
  • 45.9kForks760 open issues
  • 2023Repo created16 Mar 2023
30 days ago2 Nov
5 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

5 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about AutoGPT

Answers use this week's StackGrade data.

Is AutoGPT safe to use?

Caution. StackGrade's weekly scan of Significant-Gravitas/AutoGPT gives it a Caution label for 16 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 211 high-severity advisories in runtime dependencies, which don't change the label. 1 phrase in agent instruction files was flagged for human review (unclear). Critical advisories are counted once per package; a known issue in a locked package version does not prove AutoGPT is exploitable in your setup. Automated scan of commit ef7f41c on 2 Nov 2026, not a manual audit.

How does StackGrade score AutoGPT?

AutoGPT scores 62 out of 100 in Week 45: #14 of 52 tracked tools overall and #2 in Automation & agent frameworks. The score combines maintenance (55), adoption (91) and docs (29) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to AutoGPT?

The highest-scored other tools in Automation & agent frameworks this week: n8n (70, Caution), CrewAI (57, Caution), Dify (56, Caution), LangChain (54, Caution). StackGrade has not tested them hands-on.

What licence does AutoGPT use?

The licence listed for Significant-Gravitas/AutoGPT is MIT + Polyform Shield. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
Agent framework
License
MIT + Polyform Shield
Language
Python
Created
16 Mar 2023
Owner
Significant-Gravitas (Organization)
Forks
45,901
Homepage
agpt.co

GitHub description: “AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.”

Sources: github.com/Significant-Gravitas/AutoGPT, api.github.com/repos/Significant-Gravitas/AutoGPT, raw.githubusercontent.com/Significant-Gravitas/AutoGPT/maste. Fetched 2 Nov 2026.

Know when AutoGPT changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.