Issues

• [Security] TinyAGI unauthenticated control-plane routes allow system prompt overwrite and daemon restart

  TinyAGI/tinyagi#294 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI unauthenticated agent ID path traversal escapes the configured workspace root

  TinyAGI/tinyagi#293 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI unauthenticated administrative API allows persistent settings and agent prompt modification

  TinyAGI/tinyagi#292 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI Anthropic Adapter Disables Claude Dangerous-Tool Confirmation for Unauthenticated POST /api/message Requests

  TinyAGI/tinyagi#291 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI Terminal Escape Injection via POST /api/message Allows Operator Log Spoofing

  TinyAGI/tinyagi#290 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI allows unauthenticated API callers to exfiltrate arbitrary local files via outbound channel attachments

  TinyAGI/tinyagi#289 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI exposes an unauthenticated local control plane that leaks live events and allows persistent settings modification

  TinyAGI/tinyagi#288 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] Unauthenticated Pairing Management API Allows Arbitrary Approval of Pending Channel Senders

  TinyAGI/tinyagi#287 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] TinyAGI Unauthenticated Local Control API Allows Persistent Settings Mutation, Agent Prompt Overwrite, and Event Stream Access

  TinyAGI/tinyagi#286 · Filter by author YLChen-007 opened on Jul 7, 2026

• [Security] Unauthenticated prompt_file update allows arbitrary local file read into provider-bound prompts

  TinyAGI/tinyagi#285 · Filter by author YLChen-007 opened on Jun 20, 2026

• [Security] Unauthenticated prompt_file agent configuration allows arbitrary local file disclosure to the model provider

  TinyAGI/tinyagi#283 · Filter by author YLChen-007 opened on Jun 18, 2026

• [Security] TinyAGI allows unauthenticated API messages to invoke Claude with provider permission checks disabled by default

  TinyAGI/tinyagi#284 · Filter by author YLChen-007 opened on Jun 18, 2026

• [Security] Untrusted [send_file: ...] response tags allow arbitrary host file attachment delivery in TinyAGI

  TinyAGI/tinyagi#282 · Filter by author YLChen-007 opened on Jun 18, 2026

• [Bug]: channel setup not working

  bug
  TinyAGI/tinyagi#279 · Filter by author debamitro opened on Apr 19, 2026

• [Bug]: better-sqlite3 still needs to be rebuilt

  bug
  TinyAGI/tinyagi#278 · Filter by author debamitro opened on Apr 19, 2026

• Feature: Show full tool details in streaming output, not just tool names

  TinyAGI/tinyagi#277 · Filter by author SMouuu opened on Apr 12, 2026

• [Feature]:

  enhancement
  TinyAGI/tinyagi#275 · Filter by author Kindjhali opened on Apr 8, 2026

• [Feature]: add rtk-ai support for opencode / codex token reduction

  enhancement
  TinyAGI/tinyagi#273 · Filter by author jsapede opened on Apr 8, 2026

• [Feature]: opencode ui settings

  enhancement
  TinyAGI/tinyagi#272 · Filter by author jsapede opened on Apr 8, 2026

• [Feature]: Can only bind to localhost?

  enhancement
  TinyAGI/tinyagi#271 · Filter by author mlmr-coder opened on Mar 31, 2026

• TinyOffice SSE always shows Disconnected - Next.js rewrite buffers event stream

  TinyAGI/tinyagi#231 · Filter by author crisdias opened on Mar 16, 2026

• [Bug]: Changing heartbeat resets complete agents

  bug
  TinyAGI/tinyagi#228 · Filter by author Chavell3 opened on Mar 16, 2026
  2

• [Bug]: TinyOffice - changed settings not persistent

  bug
  TinyAGI/tinyagi#227 · Filter by author Chavell3 opened on Mar 16, 2026
  1

• [Feature]: TinyOffice - Add STAR feature to agents

  enhancement
  TinyAGI/tinyagi#226 · Filter by author Chavell3 opened on Mar 16, 2026

• [Feature]: TinyOffice UX suggestions

  enhancement
  TinyAGI/tinyagi#192 · Filter by author mczabca-boop opened on Mar 11, 2026