# Khai Hub Security Review

Status: Public/static analysis complete; controlled VM validation in progress  
Observation date: 2026-08-13  
Reference version: Windows Desktop 1.1.6, advertised Agent 3.3.0

## Scope and method

The public website, installer scripts, OAuth metadata, downloadable Windows
archive, PE metadata, Authenticode signatures, imports, strings, and recoverable
PyInstaller application structure were inspected without executing the Khai Hub
application. No authentication bypass, brute force, state-changing public API
call, private-code access, or license bypass was attempted.

Dynamic findings are not asserted until reproduced in the disposable VM.

## Package provenance

- Public archive: `https://www.khai-hub.com/desktop/Khai-Hub-Windows-1.1.6.zip`
- Size: 48,093,670 bytes
- SHA-256: `535720aad243d856e6de3e9be47015ba19ce38dbfdccfbeae1d9d1d33aa1be51`
- Main executable SHA-256:
  `33585cd5ed8b1e09b26df8210b525e8c99b538d77f045e1c4e657989fd52bc65`
- Bundled `cloudflared.exe` SHA-256:
  `8635da433b6df8194746e88ed9d2589566c20e38bfc2a80e431a348b7c765841`

Observed facts:

- The downloaded archive matched the hash embedded in the public installer.
- The ZIP had no absolute, parent-traversal, ADS, device, symlink, duplicate, or
  hidden-PE entries.
- The main executable is an unsigned x64 PyInstaller one-folder application.
- The bundled cloudflared binary is validly signed by Cloudflare and its hash
  matches the official [cloudflared 2026.7.3 release](https://github.com/cloudflare/cloudflared/releases/tag/2026.7.3).
- The [download page](https://www.khai-hub.com/download#terminal) recommends
  piping a mutable PowerShell script directly to execution and states that beta
  builds are not code-signed for public distribution.

## Recovered architecture

Observed facts:

- Desktop authentication uses a device-code flow against public Khai Hub APIs.
- A local MCP server binds to `127.0.0.1:3001`; cloudflared makes an outbound
  tunnel connection to publish a profile-specific MCP endpoint.
- The local MCP layer verifies Ed25519 JWT signature, algorithm/key identifier,
  time bounds, issuer, audience/resource, profile, and scope.
- Local controls include expected-Host checks, narrow ChatGPT CORS origins,
  request/result caps, and root-resolved structured file operations.
- Public [OAuth metadata](https://www.khai-hub.com/.well-known/oauth-authorization-server)
  advertises Authorization Code and Refresh Token grants, public clients, PKCE
  S256, `khai_hub.tools`, and `offline_access`.

Architecture inference:

```text
AI client -> profile hostname and OAuth -> Cloudflare Tunnel
          -> outbound desktop connector -> local permission/tool engine
```

## Ranked findings

### High: unsigned same-origin installation and update trust

Fact: the recommended unsigned installer obtains both the archive and expected
hash from the same mutable origin. The main executable and update metadata are
unsigned and no independent publisher key or transparency mechanism is enforced.

Inference: a compromise of the website/deployment origin could replace the
script or manifest, hash, and payload together. The matching hash proves package
consistency, not publisher authenticity.

### High: Elevated mode likely reaches arbitrary code execution

Fact: Elevated mode permits writes inside an approved root and allows several
developer-capable executables. Obvious `python -c/-m`, Node `-e`, shells, package
managers, and selected tools are promoted to Full, but script-file and helper
forms are not comprehensively constrained. Processes retain the user's full OS
token and have no filesystem/network sandbox.

Inference requiring VM proof: an authorized caller can likely write a script in
an approved root and execute it through an allowlisted interpreter, bypassing
the advertised Full-only raw-code boundary.

### High: elevation of a user-writable application tree

Fact: the complete PyInstaller tree is installed under user-writable
`LocalAppData`, while the application tells users to run it as Administrator for
admin commands. The bootloader dynamically loads sibling DLL/PYD components and
does not enforce their publisher signatures.

Inference requiring VM proof: an unelevated same-user process can replace a
sibling component that later runs at high integrity when the user elevates the
desktop application.

### High/Medium: plaintext persistent Windows credentials

Fact: device and Cloudflare tunnel bearer material is stored in
`%APPDATA%\Khai-Hub\credentials.json`. A chmod-style permission attempt is not
Windows DPAPI/Credential Manager encryption or a complete ACL hardening control.

Inference: another process running as that user can steal long-lived material
and impersonate the device or connector until revocation.

### Medium: patch lag and sensitive-data reach

Fact: the package contains Python 3.12.10 and OpenSSL 3.0.16. Newer security
releases exist in both supported lines: [Python 3.12.13](https://www.python.org/downloads/release/python-31213/)
and the [OpenSSL 3.0 release notes](https://openssl-library.org/news/openssl-3.0-notes/).
The product can read files, clipboard, accessibility state, and screen imagery;
higher levels can mutate state and run commands. Prompts, current directory,
command, and recent task output are persisted locally in plaintext task state.

Inference: malicious content or a mistaken model action has a broad opportunity
to expose sensitive screen, clipboard, file, browser, or task data within the
granted capability set.

## Public control-plane candidates for VM validation

- An authenticated dashboard bundle automatically submits a `device_login` or
  `user_code` query value to the device approval API without an explicit confirm
  step. Test with two accounts/devices before classifying this as exploitable
  device-link CSRF.
- OAuth consent requires a click but does not visibly identify the client,
  redirect URI, requested scopes, profile, or active account.
- Important pages did not return CSP `frame-ancestors` or `X-Frame-Options`, so
  clickjacking needs iframe validation.
- Test PKCE enforcement, redirect binding, state, code/request replay and TTL,
  refresh rotation/revocation, dynamic registration policy, and cross-profile
  token isolation.

## Positive controls worth preserving in AiMe

- loopback-only local MCP origin and outbound transport;
- issuer/audience/profile/scope/time-bound JWT verification;
- expected-Host and narrow browser-origin checks;
- strict request/result limits;
- per-user installation without autostart;
- signed upstream tunnel binary with a verified independent hash;
- no embedded private signing key, API key, or client secret observed.

## Limitations

Static analysis cannot establish that a package is malware-free or that a
suspected exploit is reachable at runtime. Network destinations, token lifetime,
revocation behavior, ACL effects, permission bypasses, prompt-injection impact,
OAuth isolation, and UI consent semantics remain dynamic-test items.
