Highcua
Computer-use agent infrastructure — sandboxes and SDKs for AI agents that control full desktops (macOS/Linux/Windows) and browsers.
261 inherited RCE-class surfaces — the largest here. Designed to control a whole desktop, so untrusted input reaching them could mean full machine control.
Blast radius @ 1M installs: 261,000,000 inherited surfaces (illustrative)
MedLangflow
A low-code, drag-and-drop visual builder for LLM-powered agents and workflows.
47 inherited RCE-class surfaces (including code-execution flow nodes) could run attacker-supplied code if a flow is fed untrusted input.
Blast radius @ 1M installs: 47,000,000 inherited surfaces (illustrative)
Medletta
A platform for stateful agents with long-term memory that learn and self-improve (formerly MemGPT).
34 inherited RCE-class surfaces could execute attacker-supplied code if untrusted content reaches its agent/tool paths.
Blast radius @ 1M installs: 34,000,000 inherited surfaces (illustrative)
Medpotpie
A platform that builds a knowledge graph over a codebase and exposes AI agents for software-engineering tasks.
34 inherited RCE-class surfaces could run attacker code if its codebase agents are pointed at untrusted repositories or prompts.
Blast radius @ 1M installs: 34,000,000 inherited surfaces (illustrative)
Medllama_index
A data framework connecting LLMs to external data for indexing, retrieval (RAG) and document agents.
26 inherited RCE-class surfaces (code-exec / deserialisation) could run attacker code if untrusted documents or query-tools reach them.
Blast radius @ 1M installs: 26,000,000 inherited surfaces (illustrative)
MedSuperAGI
A dev-first framework for building, running and managing autonomous AI agents with a tool/plugin ecosystem.
22 inherited RCE-class surfaces could execute attacker code once an agent tool is fed untrusted content.
Blast radius @ 1M installs: 22,000,000 inherited surfaces (illustrative)
Medjulep
A backend for durable, resumable, composable AI-agent workflows (long-running stateful flows).
21 inherited RCE-class surfaces could run attacker code if a workflow step is wired to untrusted input.
Blast radius @ 1M installs: 21,000,000 inherited surfaces (illustrative)
Medagno
A full-stack framework for building, running and managing multi-agent systems and agent platforms.
20 inherited RCE-class surfaces; also the largest reachable-in-repo count here (131). Untrusted agent input could run attacker code.
Blast radius @ 1M installs: 20,000,000 inherited surfaces (illustrative)
LowRA.Aid
An autonomous software-development agent that plans and executes coding tasks, running shell commands and editing files.
16 inherited RCE-class surfaces — consistent with a tool that runs shell by design; untrusted task input could execute attacker code.
Blast radius @ 1M installs: 16,000,000 inherited surfaces (illustrative)
Lowsemantic-kernel
An SDK for integrating LLMs into apps via plugins, planners and agent orchestration across .NET, Python and Java.
15 inherited RCE-class surfaces could run attacker code if a plugin/planner is fed untrusted input. Guard model is Python-only — weaker confidence on its .NET/C# code.
Blast radius @ 1M installs: 15,000,000 inherited surfaces (illustrative)
Lownotte
A framework for building web-browsing agents and deploying serverless browser-automation functions.
13 inherited RCE-class surfaces; 0 reachable-in-repo (all liability is inherited-on-install). Untrusted pages could drive code execution.
Blast radius @ 1M installs: 13,000,000 inherited surfaces (illustrative)
Lowbabyagi
An experimental autonomous task-management agent that generates, prioritises and executes a self-extending task list.
11 inherited RCE-class surfaces could run attacker code if the task-execution loop is wired to untrusted input.
Blast radius @ 1M installs: 11,000,000 inherited surfaces (illustrative)
