Agent platforms are unusual among web applications because the credential they hold is metered. An exposed blog leaks text; an exposed agent platform leaks a billing relationship, and the bill arrives continuously until someone notices.

The numbers

Measured through ZoomEye on 2026-10-23, page size one, all sub-types:

  • app="AgentGPT" returned 1,022.

  • title="AgentGPT" returned 984.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBZ2VudEdQVCI%3D

This is the closest agreement in the series so far, within a few percentage points, and the near-match is worth a sentence. It suggests deployments that present the product's own page rather than being embedded in something else, which fits a tool people self-host for themselves rather than integrate into a portal. It also suggests the fingerprint and the title are describing substantially the same set, so either query gives a reasonable estimate of the population rather than one being noise.

Just over a thousand reachable instances is a small surface by the standards of a monitoring platform. For this class of software it is the right order of magnitude to matter, because the value per host is high.

What the platform is and what it holds

AgentGPT runs autonomous loops against a goal, which means it is a client for a model provider, and being a client requires a credential. Self-hosted deployments therefore carry an API key for OpenAI or a compatible endpoint, configured through environment variables or a settings file inside the deployment.

That key is the object of value, and it has properties that ordinary session tokens lack:

  • It is long lived, because it is a deployment secret rather than a user session.

  • It is not scoped to the application, because provider keys grant account-level access to models, and in some accounts to billing, fine-tuning jobs and usage data.

  • It is directly monetisable, since a stolen key is spend, not data. There is no need to sell anything or extort anyone.

There is a second, quieter asset: the prompt history. A goal typed into an agent often contains the context the user was working with, including internal names, code fragments and occasionally customer detail. Whatever the agent collected while iterating on that goal is stored alongside it.

The exposure patterns

  • Unauthenticated deployment. These are single-user tools built for a developer's own machine, and several deployment guides never mention adding authentication. On a public address, that is an open proxy to a paid model API.

  • Key in a browsable location. Environment variables are safer than files, but a container built from a template can still ship a .env file into a served directory. A file read is then a key disclosure.

  • Shared instance with no separation. One key serving several users makes attribution impossible, so an abusive loop cannot be traced to a person.

  • Runaway cost. Agent loops pursue a goal until told to stop. An instance exposed without limits can generate continuous spend with no operator present.

What to do

  • Put authentication in front of the deployment. For a single-user tool, that is a reverse proxy with a password rather than a new feature request.

  • Use a provider key scoped to the deployment with a hard spend limit, so the failure mode is a blocked request rather than an invoice.

  • Keep the key in a secret mount rather than an environment file inside the image, and remove any .env from directories the web server can serve.

  • Set a maximum iteration or token budget in the agent configuration, because the cost control belongs in the application.

  • Review provider usage for calls from addresses you do not recognise. A stolen key is visible as spend before it is visible as anything else.

Limitations

ZoomEye totals reflect observation rather than a full census and drift between queries. A fingerprint match does not establish whether the instance requires authentication, whether a key is configured, or whether that key carries a balance. The near-agreement between the two queries describes how the product presents itself, not the security posture of any deployment.

References

  • ZoomEye application fingerprint query for AgentGPT, run 2026-10-23, total 1,022.

  • ZoomEye title query for AgentGPT, run 2026-10-23, total 984.

  • AgentGPT project documentation covering deployment, environment configuration and provider keys.