devops-bot-sdk 1.6.91

persistenceCovers 1.6.70 and 1.6.91Reviewed by BitbisonUpdated 2026-10-25

Running agentos-auto, even with --help, installs a control panel service that keeps running after logout and a timer that reinstalls the package every day. With passwordless sudo it also records every command run on the machine.

What the analysis saw

Our sandbox installed devops-bot-sdk 1.6.70 and ran each of its commands with --help. agentos-auto --help did not print help. It ran the full start-up path:

• It wrote ~/.config/systemd/user/agentos-ui.service, agentos-update.service and agentos-update.timer.
• It ran systemctl --user enable --now for the panel and for the timer.
• It ran loginctl enable-linger. The panel keeps running after the user logs out.
• It tried sudo -n and read the firewall state with ufw status.
• It wrote ~/.agentos/auto.log and ~/.agentos/auto.pid and read the project's .env.

No network traffic left the sandbox.

1.6.91

Our sandbox installed 1.6.91 and ran each of its commands with --help, as for 1.6.70. agentos-auto --help again ran the full start-up path:

• It wrote the same three systemd units, ran systemctl --user enable --now for the panel and the timer, and ran loginctl enable-linger.
• It tried sudo -n, read ufw status, read the project's .env and started itself in the background.
• With the network on, it reached only PyPI, to check for an update.

We also read its source. The files, port, hosts and addresses are unchanged, and the same AGENTOS_NO_* variables skip each step.

1.6.91 also reads Claude Code's login token from ~/.claude/.credentials.json. It sends the token only to Anthropic's usage endpoint, to hold back scheduled agent runs when the Claude plan is nearly used up. It does not send it to the vendor. Set AGENTOS_USAGE_GATE=0 to turn this off. The --help run did not reach this code.

Why it happens

In sdk/run_auto.py, any first argument that starts with - selects the run command. --help is no exception. run first checks for updates. The update step then sets up the service, the timer and command auditing on the machine. It skips a step only when an AGENTOS_NO_* variable is set.

What gets installed

• agentos-ui is a control panel on port 8765 on every network interface. It restarts if it stops. Its API runs AI agents and shell commands on the machine. Programs on the same machine can use it without a token. Remote callers need the account's co_ API token. The vendor's backend at 20.12.201.148 and 20.127.87.169 is allowed in by default.
• agentos-update.timer reinstalls the package once a day from PyPI or from the vendor's GitHub repository.
• If the user has passwordless sudo, it installs auditd when it is missing and adds rules that record every command run on the machine. The panel sends these records to the vendor's backend every five minutes.
• When run as root, it also opens port 8765 in the firewall to any address.

The README describes none of this.

Is it malicious?

No. We read the source of 1.6.70. It has no hidden code and no obfuscation. 1.6.70 does not read credential files or browser data. Its own comments say so. 1.6.91 reads Claude Code's token, as described above. It talks only to the vendor's own services. Nothing runs when the package is installed.

The package is a remote management agent for servers. This is what it is built to do. The problem is that agentos-auto sets all of this up the first time it runs, help included. On a developer's machine that leaves a background service and a daily self-updater the user never asked for. On a CI runner with passwordless sudo it also installs auditd and records every command for the rest of the job.

How to avoid it

Do not run agentos-auto to read its help. To use the package without the setup, set AGENTOS_NO_UPDATE=1, AGENTOS_NO_SERVICE=1, AGENTOS_NO_AUDIT_SETUP=1 and AGENTOS_NO_FIREWALL=1.

To remove it:

systemctl --user disable --now agentos-ui agentos-update.timer
rm ~/.config/systemd/user/agentos-ui.service ~/.config/systemd/user/agentos-update.service ~/.config/systemd/user/agentos-update.timer
loginctl disable-linger "$USER"
sudo rm -f /etc/audit/rules.d/agentos.rules && sudo augenrules --load

Links

• devops-bot-sdk on PyPI
• devops-bot-sdk 1.6.91 on PyPI
• Source repository