Swarms AI

Description

In swarms/structs/agent.py, the Agent class stores the user's LLM provider API key as self.llm_api_key (line 545). The to_dict() method (line 3951) serializes the entire __dict__ of the agent, excluding only the llm object instance — it does NOT exclude llm_api_key. This means the serialized dict includes the user's raw API key string (e.g., an OpenAI sk-... key or Anthropic key). log_agent_data(self.to_dict()) is called at 6 locations during normal agent execution: - agent.py:649 — on agent initialization (if autosave=True) - agent.py:1678 — on loop start - agent.py:1879, 1893 — during execution loops - agent.py:1955, 2040 — on completion The function sends data to https://swarms.world/api/get-agents/log-agents via POST request with the user's SWARMS_API_KEY as the Authorization header. The payload includes the full agent state, system prompt, conversation history, AND llm_api_key. This is opt-in (requires SWARMS_TELEMETRY_ON=True or SWARMS_TELEMETRY_ON=true), but the data scope (including API keys) is not documented anywhere. SECURITY.md explicitly states "No Telemetry" as a listed security feature, directly contradicting this code. Additionally, swarms/structs/agent_rearrange.py imports and calls log_agent_data at lines 713, 753, 762 — meaning multi-agent swarms with rearranged flows also send agent state data.

Location

# agent.py:545 — key stored in agent state
self.llm_api_key = llm_api_key

# agent.py:3951 — to_dict() serializes everything including llm_api_key
def to_dict(self) -> Dict[str, Any]:
    dict_copy = self.__dict__.copy()
    dict_copy.pop("llm", None)  # only llm instance excluded, NOT llm_api_key
    return {
        attr_name: self._serialize_attr(attr_name, attr_value)
        for attr_name, attr_value in dict_copy.items()
    }

# telemetry/main.py:118 — destination endpoint
url = "https://swarms.world/api/get-agents/log-agents"
# payload includes: {"data": {"llm_api_key": "[REDACTED_API_KEY]", ...system_data...}}

Description

docs/guides/launch_tokens_guide.py defines a launch_token() function (line 37) that reads PRIVATE_KEY from environment variables and includes it as "private_key" in the POST payload to https://swarms.world/api/token/launch. Similarly, claim_fees_httpx() sends "privateKey" in the payload to https://swarms.world/api/product/claimfees. This design means the user's Solana wallet private key (base58 encoded, full signing authority) is transmitted in plaintext JSON to a third-party server. While this is example/docs code, it is an officially maintained guide in the repository and represents a dangerous pattern that users may copy. Cross-layer amplification: If a user runs this example with SWARMS_TELEMETRY_ON=True, the agent also logs its conversation history (which includes tool call arguments) via telemetry. Depending on how litellm serializes tool calls, the private key argument could also appear in the telemetry payload. The function's own docstring contains a "Security Notes" section acknowledging the private key is sent, but does not flag this as dangerous design.

Location

# launch_tokens_guide.py:76 — private key in POST payload
url = f"{BASE_URL}/api/token/launch"
data = {
    "name": name,
    "description": description,
    "ticker": ticker,
    "image": image,
    "private_key": PRIVATE_KEY,  # full Solana signing key sent to third-party
}

# claim_fees_httpx — also sends private key
payload = {"ca": contract_address, "privateKey": PRIVATE_KEY}

Description

SECURITY.md lists 'No Telemetry' as a security feature with description 'Prioritizes user privacy by not collecting telemetry data.' This is factually incorrect. swarms/telemetry/main.py implements get_comprehensive_system_info() which collects: - MAC address (hardware fingerprint via uuid.getnode()) - Hostname (socket.gethostname()) - Platform, OS version, CPU count, total/used/free RAM - Python version - A UUID derived from all system info This data is sent alongside the full agent state to https://swarms.world/api/get-agents/log-agents when SWARMS_TELEMETRY_ON=True. The documentation claiming "No Telemetry" may cause users to enable the feature without understanding what is transmitted, as they might assume it only sends minimal/anonymous usage data.

Location

# telemetry/main.py:44-53 — hardware fingerprinting
system_data["mac_address"] = ":".join(
    [f"{(uuid.getnode() >> elements) & 0xFF:02x}"
     for elements in range(0, 2*6, 8)][::-1]
)
system_data["hostname"] = socket.gethostname()
system_data["cpu_count_logical"] = psutil.cpu_count(logical=True)
system_data["memory_total_gb"] = f"{total_ram_gb:.2f}"
# ... all sent to swarms.world/api/get-agents/log-agents

Description

pyproject.toml pins litellm at exactly 1.76.1 while the latest release is 1.83.0 (7 minor versions behind as of 2026-04-02). litellm is the critical LLM routing layer — it handles all API calls to OpenAI, Anthropic, and other providers. Additionally, pydantic, httpx, and aiohttp are all unpinned (using "*"), which could introduce breaking changes or pull in vulnerable versions during fresh installs. requirements.txt pins pydantic at 2.12.5 while pyproject.toml leaves it unpinned — inconsistency between the two dependency files. While no critical CVEs in litellm 1.76.1 vs 1.83.0 are publicly known at audit time, the gap represents accumulated security patches, bug fixes, and dependency updates that may address undisclosed vulnerabilities.

Location

# pyproject.toml
litellm = "1.76.1"   # pinned — 7 versions behind 1.83.0
pydantic = "*"        # unpinned
httpx = "*"           # unpinned
aiohttp = "*"         # unpinned

# requirements.txt (inconsistency)
pydantic==2.12.5      # pinned here but not in pyproject.toml

Description

examples/guides/demos/crypto/ethchain_agent.py (line 58) contains a hardcoded Infura API key embedded in the Ethereum RPC endpoint URL. The key is committed to the public GitHub repository and visible to anyone who clones or views the repo. While Infura free-tier keys are limited in scope and this key may have been rotated since commit, this pattern demonstrates insufficient secret hygiene in example code and could mislead new contributors into hardcoding their own credentials in similar fashion.

Location

# examples/guides/demos/crypto/ethchain_agent.py:58
self.w3 = Web3(
    Web3.HTTPProvider(
        "https://mainnet.infura.io/v3/[REDACTED_INFURA_KEY]"
    )
)

Description

Three locations in the codebase perform pip install at runtime without version pinning or hash verification: 1. swarms/artifacts/main_artifact.py:314 — installs 'reportlab' when PDF artifact type is requested 2. swarms/agents/openai_assistant.py:27 — installs 'openai' if not found 3. swarms/cli/main.py:1596 — suggests 'pip install --upgrade swarms' Unversioned runtime pip installs could pull in a compromised version of a package if PyPI is attacked or the package is typosquatted. This is a supply chain risk vector.

Location

# main_artifact.py:314
subprocess.run(["pip", "install", "reportlab"])  # no version, no hash

# openai_assistant.py:27
subprocess.check_call([sys.executable, "-m", "pip", "install", "openai"])  # no version