AIDE ML

AIDE has no agent identity or authorization layer. The LLM-written training script runs in a child process of the agent, as the user who launched it, with the full environment inherited, so the model's code can read the LLM API keys and anything else the user can reach (home directory, cloud CLI credentials, SSH keys). Nothing narrows that ambient authority.

There is no human approval anywhere. Every step, the model writes a complete Python program and AIDE executes it immediately, for 20 steps by default, with no review of the code. The single most powerful action, arbitrary code execution, is the only action and it is never gated.

AIDE's only action is 'run this whole Python program'. There is no argument validation, path containment, network allowlist or quantity bound; the prompt even tells the model it may use any package. The workspace directory is only the working directory, not a boundary.

By default, model-written code is executed with Python's exec() inside a forked child process on the host, as the same user, with the full environment (including LLM API keys) and unrestricted network. The only containment is a wall-clock timeout. The repository also ships a Dockerfile that runs AIDE as a non-root user in a stock container; that narrows host reach, but it is an optional deployment mode, the container still receives the API key, and it has no hardening.

Dataset files in the user's data directory are previewed into the model's system prompt, and small text files are pasted in verbatim, alongside the code's own execution output. Nothing distinguishes this content from instructions, and the model's next action is a program that runs with network access and the user's credentials. A poisoned dataset file can therefore lead to credential theft and destructive actions with no human involved.

AIDE has no long-term memory: the in-run 'Memory' summary lives only in the current process and the saved journal is never read back. Configuration comes from the package's own config.yaml and command-line arguments, not from the data or workspace directory. However, nothing protects that configuration or the Python environment from the agent's own generated code, which runs as the same user and could plant files that persist into future runs.

AIDE loads no plugins, MCP servers, hub tools or remote prompts. Generated code can import or install anything, but that is arbitrary code execution and is scored under code-execution isolation, not as an extension system.

API keys are read from environment variables and handed, along with the rest of the environment, to the process that runs model-written code. There is no masking or redaction anywhere; execution output (which a script could fill with environment variables) is sent back to the model and saved in the run journal. There is no telemetry, and verbose request logging is off by default.

After every step AIDE saves a structured journal (each script, its output, execution time, the reviewer's analysis and a timestamp) plus the best solution into a per-run log directory. That is a usable record of what ran. It has no actor attribution or integrity protection, it is written after execution, and the executed code runs as the same user so it can alter or delete the log.

Runs are bounded by a step count (20 by default) and a per-script timeout (one hour by default) that interrupts and then kills the child process. There is no overall time budget and no token or cost cap, and the timeout kills only the direct child, so processes a script spawns itself can survive. Ctrl+C stops the run.