Microsoft publishes AutoGen. VideoSurfer can extract audio
from a local video and save a still. Extract already refuses
a URL path and a write outside the working directory. Save
screenshot did not. An agent-chosen
../escaped.png goes to
cv2.imwrite. The patch is in
PR 8200.
| Document | HB-AR-2026.6 / public source review, VideoSurfer tools |
|---|---|
| What this is | A research note and an opinion. Microsoft did not hire Hackerbane for this. |
| System | microsoft/autogen, AutoGen VideoSurfer tools |
| Scope |
extract_audio and save_screenshot
in autogen_ext.agents.video_surfer
|
| Review commit | main @ 027ecf0 |
| Upstream | PR 8200 (open) |
| Date | 7 September 2026 |
| Author | Barney Chambers, Hackerbane |
If you have not used AutoGen: it is Microsoft's library for
building multi-agent systems. VideoSurfer is an optional
agent that answers questions about a local video. Two of
its tools write files:
extract_audio and
save_screenshot. Extract already treats the
output path as untrusted. Save screenshot did not.
On main at commit 027ecf0:
# extract_audio reject URL video_path output must stay under cwd # save_screenshot cv2.VideoCapture(video_path) cv2.imwrite(output_path, frame)
Default VideoSurfer puts save_screenshot on
the tool list. An agent (or a prompt that steers the model)
can pick ../escaped.png or a URL video path.
I opened a patch that shares one helper with extract. It is
PR 8200.
Microsoft did not hire this review. The name on the cover
names the project I read.
VideoSurfer is a local extra. The model already has tools that read a video on disk. I still scored this because extract already treated the write path as untrusted, and save screenshot did not. Microsoft asks that GHSA-class bugs go to MSRC. This note is a hardening miss that matches an existing check. The PR is public for that reason.
| # | ID | Action | Status on 7 Sep 2026 |
|---|---|---|---|
| 1 | MED-01 | Use the same URL and cwd rules on save_screenshot that extract_audio already uses. | Patch open. PR 8200. |
This is not a full audit of AutoGen. I split the tree and
read code executors, Studio routes, HTTP and MCP tools,
FileSurfer, WebSurfer, termination conditions, and
VideoSurfer. Some other misses already have open PRs
(TextMentionTermination sources, FileSurfer
base_path dump). The finding I can prove
with a unit test on current main, and that
was not already patched, is the screenshot write path.
| In scope |
python/packages/autogen-ext/src/autogen_ext/agents/video_surfer/tools.py:
extract_audio and save_screenshot.
Tests in
tests/agents/test_video_surfer_path_guards.py.
|
|---|---|
| Out of scope |
Documented local code execution. Studio auth and IDOR
issues I did not patch in this note (Microsoft's
SECURITY.md points GHSA-class bugs at MSRC). Nested
FunctionTool exec on validate. WebSurfer
download names. AutoGen .NET.
|
| Method |
Compare extract with save screenshot. Add pytest
cases that fail on 027ecf0 and pass
with the patch. The test file stubs
cv2, ffmpeg, and
whisper so it runs without the
video-surfer extra.
|
| Retest |
python3 -m pytest python/packages/autogen-ext/tests/agents/test_video_surfer_path_guards.py -q
|
| ID | Severity | Title | Status |
|---|---|---|---|
| MED-01 | Medium | save_screenshot skips the extract_audio path guards |
Patch open (PR 8200) |
I called this Medium, not High, because VideoSurfer is a local optional extra and the agent already works on a video file on disk. The miss is still real: one tool sanitises, the other does not.
python/packages/autogen-ext/src/autogen_ext/agents/video_surfer/tools.py · extract_audio · save_screenshot
Extract comments that it refuses a URL and a write
outside cwd, then checks both. Save screenshot opens
the video and writes the frame with the raw
output_path. On
027ecf0 the three new
save_screenshot tests raise from mocked
OpenCV instead of
ValueError for a cwd or URL miss.
After the patch they raise the same
ValueError extract already uses.
Extract's own two tests already passed on
027ecf0. The helpers keep those
error strings.
| When | What |
|---|---|
| 7 Sep 2026 |
Review commit 027ecf0. MED-01 confirmed.
Tests fail on that commit and pass with the patch.
5 passed with the patch.
|
| 7 Sep 2026 | Opened PR 8200. Still open when this note was written. |
To retest MED-01, run the command in section 2. A normal cwd-relative screenshot path must still reach OpenCV after the guards.
Read this before you treat anything above as advice.
This file is a public research note. Microsoft did not hire Hackerbane. There is no services agreement, statement of work, or client relationship behind it. The Microsoft name on the cover names the project I read. It is not a partnership badge.
What you have is an opinion about the files and commits named in section 2. It is not a certificate. It is not an endorsement of Microsoft, of AutoGen, or of the patch. It is not a claim that the rest of AutoGen is safe, or that it is broken.
I am not telling you to merge, deploy, buy, or sell anything. This is not investment advice, legal advice, or a security guarantee. If you ship software, you own that risk. If you run VideoSurfer, you own that risk.
Hackerbane and I accept no liability for how anyone uses this note, for bugs it does not name, or for loss that follows from relying on it. Findings can be wrong, incomplete, or already stale the day after the review commit. Code added after that commit was not reviewed. A retest covers only the checks it names.
You may share this file. Sharing it does not create a contract and does not make the reader a client.
This note is provided as-is, as available, with all faults. To the maximum extent the law allows, Hackerbane disclaims every warranty, express or implied, including merchantability, fitness for a particular purpose, title, and non-infringement. No promise that this text is accurate, complete, or free of error, or that any error will be fixed.
Nobody may rely on this note as a professional engagement. It is not financial, tax, legal, or regulatory advice. No third party is a beneficiary of it.
| Critical | Someone could steal funds or hurt people with what I looked at. |
|---|---|
| High | The check you think you have does not work in the common case. |
| Medium | A real miss, less common in the output I care about here. |
| Low | Real, but limited, or it needs an unlikely setup. |
| Informational | On the record. Not scored as a bug. |
The coloured bars are labels. The word High or Medium is what counts.