AutoGPT Platform v0.8.3 Changes Agent Approval: Sandbox Commands Judged by Supervisor Model

AutoGPT released Platform beta v0.8.3 on October 8, introducing a substantial change to agent execution permissions: in Ask First mode, shell calls previously required user confirmation each time. They are now judged by the action supervisor, allowing routine sandbox tasks such as installing packages, downloading code, building, and testing to continue automatically. The change is included in the release notes and is relevant to teams that need long-running coding agents. Release announcement

The core change switches the shell policy from ASK to JUDGE. The supervisor model is still expected to stop data exfiltration, remote modifications, paid calls, sending messages, and persistent file deletion or overwriting that the user did not request. To avoid judging commands by name alone, the system reads directly executed scripts and checks shell login files changed after sandbox creation. Calls are held for confirmation if the execution target cannot be identified or its contents cannot be read. Implementation and test details

In tests of the supervisor model reported by the maintainers, the number of routine sandbox commands allowed rose from 59/87 to 86/87, while external actions continued to require confirmation in all 90/90 cases. However, only 28/30 instances of unrequested persistent file deletion and overwriting were blocked, showing that semantic judgment can still miss cases. These figures come from a small set of labeled examples and should not be taken as a security guarantee for production environments. The PR also lists limitations: programs run indirectly through make, npm scripts, or other scripts, and files modified after inspection but before execution, are not fully covered. Test results and limitations

The technical significance is fewer approval interruptions in agent workflows, alongside more execution evidence available to the supervisor model. When upgrading, engineering teams should retest their own script chains, data upload and working-directory cleanup workflows, and verify the COPILOT_AUTO_MODE setting and behavior when the supervisor model fails. Also note that the official documentation lists the autogpt_platform directory as licensed under Polyform Shield; check the applicable terms before adopting or redistributing it. Official platform documentation