Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.
Cybersecurity Top 100 / #72ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol
Agent framework · Apache-2.0 · GitHub; Hugging Face Hub

Hugging Face smolagents

Minimal agent library from Hugging Face with code-agent support and Hub integrations. Publisher: Hugging Face. Also ranked in Technology & Software Engineering (#73), Insurance (#78), Legal (#80).

Vendor page ↗+ CompareExport JSON
Trust profileas of 2026-10-26
Publisherlikely · Repository ownership or inferred publisher domain — repository or Hub account ownershiplikely
Complianceno evidence about this agent · 8 vendor-level records (inherited)T5
Security3 CVEs linked in the registry · 2 critical/high · newest 2026-07-17linked
ProtocolsModel Context Protocol (MCP) not checked — not probed: URL is on a code host, which never carries a publisher's well-known filesAgent2Agent (A2A) not checked — not probed: URL is on a code host, which never carries a publisher's well-known filesAgentic Resource Discovery (ARD) not checked — not probed: URL is on a code host, which never carries a publisher's well-known files0 / 3
TracesNone found — nobody has published what this agent does under attacknone
Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Publisher unconfirmed: the evidence below is shown but not counted in the governance score, because nothing yet ties this listing to Hugging Face beyond repository or Hub account ownership. A vendor-domain page, marketplace listing, ARD manifest or A2A card would confirm it.

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe Hugging Face, not this agent specifically.

Traces — under attack, in defence, in incidents

none public · what a trace is

No public trace found. Nobody has published what Hugging Face smolagents does when its inputs carry instructions it should not follow, when a tool asks for credentials, or when a task invites a destructive command. Defenders can't learn from what they can't see: run it in a sandbox before the pilot and keep the transcript, or ask the vendor to publish one.

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

3 linked · the registry
CVE-2026-13448
2026-07-17
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flo…
Code execution · Auth bypass · fix known · unreviewed
Critical 9.8
CVE-2025-11844
2025-10-22
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function c…
Data exfiltration · fix known · unreviewed
Medium 5.4
CVE-2025-9959
2025-09-03
Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt I…
Prompt injection · Code execution · unreviewed
High 7.6

All 3 in the registry → Severity is the official record's; nothing here enters the score. Links are by listed product, so a CVE that names a different component of the same platform may be missing.

Compliance evidence

Jurisdiction: US + EU · 10 frameworks shown
–
CSA STAR
T5 Unknown
Nothing found in the sources checked.
Scope: — · CSA STAR Registry
ask the vendor
–
ISO 42001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

8 records matched at organisation level
○
FedRAMP
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
GDPR
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
GDPR · DPA available
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
HIPAA
T4 Vendor-claimed · vendor-level
BAA available
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
ISO 27001 · ISO 27001
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
PCI DSS
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
SOC 2
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
SOC 2 · SOC 2 Type II
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 2 vendor-claimed⚠ 0 issues linkedas of 2026-10-26
○ ClaimedVendor-claimed (vendor page, 2026-10-26).
○ ClaimedDPA available: Vendor-claimed (vendor page, 2026-10-26). A DPA is a contract you still have to sign and review.
– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.
☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

Nothing linked from Hacker News, GDELT, GitHub releases or the vendor's feed in the last 90 days.

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Cybersecurity score

66
security profile · sar-score-2.0 · #72 of 100 in the curated list
Adoption / usage24 / 30
Trust & security16 / 25
Project / product health20 / 20
Ecosystem / interoperability13 / 15
Domain expertise / fit35 / 100
Governance / compliance evidence0 / 100
Docs / transparency10 / 10

Raw component / maximum, then weighted by the security profile (adoption 20, trust 25, project 15, ecosystem 10, domain 15, governance 10, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (8)
FedRAMP — vendor-claimed, vendor-level source
GDPR — vendor-claimed, vendor-level source
GDPR DPA available — vendor-claimed, vendor-level source
HIPAA — vendor-claimed, vendor-level source
ISO 27001 — vendor-claimed, vendor-level source
PCI DSS — vendor-claimed, vendor-level source
SOC 2 — vendor-claimed, vendor-level source
SOC 2 Type II — vendor-claimed, vendor-level source
Unknowns to check (6)
Your lawful basis and DPIA for PHI and personal data the agent will touch
That the SOC 2 report period covers the components you will use; request the report under NDA
That the HIPAA BAA is offered for this product tier and region
Whether the ISO 27001 certificate scope names this service, or only the platform
Current FedRAMP status with the agency, if government use is intended
The transfer mechanism you will rely on; DPF covers EU-to-US transfers only
Suggested restrictions for a pilot (1)
No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category
vendor pageclaims
NVDsecurity (CVE keyword search)
Hacker News, GDELT, vendor feedsnews and chatter
First seen2026-10-26
Recordres_7f69803e36148c8f
Open the full record (JSON) →