PraisonAI's "AgentOS" FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for "GHSA-pm96-6xpr-978x" / "CVE-2026-40151". The public AgentOS advisory is published as an instruction-disclosure issue with affected versions "< 4.5.128" and patched version "4.5.128". However, "v4.5.128", latest release "v4.6.57", and current main still register "GET /api/agents" and "POST /api/chat" without authentication. The chat route directly calls "agent.chat(request.message)". No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents.