How an AutoGPT Email Block Became an SSRF Surface

The vulnerability, catalogued as CVE‑2026‑33234, stems from AutoGPT’s reliance on Python’s smtplib.SMTP to implement its “send email” block. While the platform’s HTTP‑based blocks enforce a strict IP blocklist that filters private ranges, loopback, and cloud‑metadata addresses, the SMTP path bypasses that filter entirely. An attacker can supply any hostname or IP in the “SMTP Server” field, point it at a non‑mail port such as 22, and the library will read the remote service’s greeting. The resulting exception, containing the raw banner (for example, an OpenSSH 2.0 string), is returned un‑sanitized in the API response, effectively turning a benign email feature into an internal SSRF vector that discloses version information for SSH, MySQL, Redis, and even confirms the presence of cloud‑metadata endpoints.

This issue illustrates a recurring blind spot in AI‑driven automation platforms that expose modular “blocks” for user‑defined workflows. Projects like AutoGPT, which boast over 160 k GitHub stars and promise autonomous code generation, often prioritize rapid feature integration over uniform security hardening. Similar products—LangChain‑based agents, CrewAI, and other LLM‑orchestrated toolkits—frequently expose multiple outbound protocols (HTTP, SMTP, FTP, WebSocket) without a unified validation layer. The AutoGPT case shows how an isolated protection mechanism can be circumvented when developers assume a single protocol’s safeguards suffice, a pattern that has led to SSRF‑type bugs in other AI‑assisted services.

The practical risk is a two‑step internal reconnaissance capability for any user who can obtain a valid API token. By iterating over internal IP ranges and common ports, an adversary can map live hosts and harvest version strings, which may later be leveraged to exploit known vulnerabilities in exposed services such as outdated SSH daemons or unauthenticated Redis instances. Although the flaw requires authentication and does not directly grant code execution, the information leakage can accelerate lateral movement in compromised environments. Watch for patches that extend blocklist checks to all outbound sockets, and monitor whether other AutoGPT‑compatible blocks (e.g., FTP or raw TCP) suffer similar oversights. Vendors should audit every network‑bound primitive for consistent access control, and users should enforce least‑privilege API tokens to limit exposure.