Dify AI Security for Dify Agents, Workflows and MCP Tools

Dify changed what an agent is this summer. Release 1.16.0, published July 17, 2026, introduced Dify Agent as a beta. Dify's documentation describes it plainly: it works in a sandbox of its own, "it runs commands, installs programs, and reads and writes files, so it takes on open-ended work rather than just calling the tools you configured." The release notes carry a warning in bold that we think every buyer should read twice: "You should provide Dify Agent services only to trusted, non-malicious users."

Release 1.17.0 on August 25 built on that. Agent shell and code execution can now run on E2B cloud sandboxes as well as locally. Build-time home snapshots capture the sandbox home directory, including installed packages and prepared files, and restore it on every run of the published agent. Workspace-level Skills arrived as reusable, versioned packages of code and tool definitions that agents discover and invoke. The same release raised the default APP_MAX_EXECUTION_TIME and WORKFLOW_MAX_EXECUTION_TIME from 1,200 to 3,600 seconds, so a run can now go three times longer before the platform stops it.

Release 1.17.1 on September 10 then fixed the issue that matters most for anyone who already had agents in production. In Dify's words: "Agent skills bypassed the SSRF private-network policy. Agent traffic goes through a separate proxy that ignored SSRF_PROXY_ALLOW_PRIVATE_IPS and SSRF_PROXY_ALLOW_PRIVATE_DOMAINS, so the allowlist you configured for workflows did not constrain the agent runtime." Both proxies now honor the same allowlist.

The honest read: Dify's team is shipping security fixes fast, and the direction is right. But an agent that can run shell commands, install packages and keep that state between runs has a much larger reach than a workflow node that calls one HTTP endpoint. Any credential the sandbox can see, any internal host it can resolve and any tool a Skill exposes is now inside the blast radius of a prompt injection hidden in a document or web page the agent reads.

Dify's repository lists more than twenty security advisories, and 2026 has been busy. Several came from outside research. Imperva published two findings on May 18, 2026, a one-click account takeover through SVG handling fixed in 1.13.1 and a cross-tenant source code disclosure in the sandbox fixed in 1.13.3, and summarized the stakes in one sentence: "API keys, OAuth tokens, and model configurations stored in Dify can be extracted, enabling lateral movement into every connected external service."

Zafran Security published DifyTap on June 22, 2026: four vulnerabilities, two critical, two exploitable without authentication, three with cross-tenant impact on Dify's multi-tenant cloud. CVE-2026-41947 (CVSS 9.1) let any console user configure tracing for apps they did not own, which turns into a persistent copy of another customer's chats. CVE-2026-41948 (CVSS 9.4) reached the internal Plugin Daemon API. Zafran states all four are patched in 1.15.0, and notes the PDF parsing stack ran a PDFium build vulnerable to CVE-2024-5846 for more than 18 months.

The MCP finding deserves a second look. Dify's advisory says "An authenticated user can modify MCP server configurations belonging to other applications in the same workspace without proper authorization," rated high at CVSS 7.1. The pattern behind it, and behind most of the list, is authorization that trusted an ID in the request. That is a bug class platforms fix one endpoint at a time. A control that sits outside the platform and checks every tool call against its own policy does not depend on each endpoint getting it right.

If you self-host, the minimum bar today is 1.17.1. Read its upgrade guide first: deployments using the bundled Weaviate must complete a staged upgrade from 1.27.0 to 1.39.2, because Dify warns that skipping minors "can silently and permanently break vector search."

Dify's Human Input node is the closest thing the platform has to an approval gate, and it is a good node. It pauses a workflow, shows a form with variables such as the AI draft or the proposed refund, collects edits, and routes on the button the reviewer clicks. Since 1.17.0 it also works inside Loop and Iteration nodes, so you can review each item in a batch rather than only the batch as a whole.

Three details in Dify's own documentation decide whether it can carry a high-value approval:

1. Email delivery is a bearer link. The documentation says an email request can go to workspace members, external addresses or the whole workspace, and "Anyone with the link can respond, no Dify account required." A forwarded email, a shared mailbox or a ticket that quotes the link gives approval rights to whoever reads it.
2. Web app delivery does not cover triggered runs. The web app form is "Not available in workflows started by a Trigger." Scheduled and webhook-started workflows, which are usually the unattended ones, can only use email.
3. Timeouts end the run unless you wire them. The default timeout is three days, and "If no timeout branch is connected, the workflow ends." That fails safe for a payout, but it fails silently for a time-sensitive task unless someone builds the fallback path.

The node also only exists where a builder placed it. Dify Agent runs inside a single Agent node, choosing its own commands and tool calls inside that step, so a Human Input node before or after it cannot hold one specific action in the middle.

Our human approval for AI agents page shows what an approver sees and how holds expire.

Dify's marketplace already has several security options, and some of them are good enough that you should not buy anything else. Dify has published integrations with the Palo Alto Networks AI Runtime Security plugin, which puts a scanning engine in front of model calls, user inputs and model responses, and with an Azure AI Content Safety container plugin. Microsoft's open-source Agent Governance Toolkit announced a governance plugin in the Dify marketplace in April 2026, and an open-source OpenGuardrails plugin covers prompt injection and sensitive data checks.

These tools mostly inspect text. That is valuable, and it answers a different question from the one that causes losses. A guardrail can tell you a retrieved document looks like an injection attempt. It cannot tell you whether this claims agent, acting for this adjuster, should approve this 8,400 dollar payout to a new bank account.

Two of those six rows say buy nothing, and we mean it. A Dify chat app that answers employee questions from a knowledge base, with no write tools and keys scoped to one dataset, is well served by Dify's moderation and a content safety plugin. The case for a runtime layer starts when Dify apps or agents can pay, send, change records or reach internal systems.

One licensing note for teams planning around self-hosting: Dify's license is a modified Apache 2.0. It allows commercial use, but operating a multi-tenant environment from the source code requires written authorization, and the console logo and copyright cannot be removed. If you run one workspace per business unit for internal teams, read that clause with counsel before you scale.

You keep building in Dify the way you do now. The change is where outbound calls go and where write credentials live.

1. Get to 1.17.1 first. Follow the staged Weaviate upgrade if you use the bundled vector store, confirm SECRET_KEY is not a value copied from an old example file, and test that agents cannot reach internal addresses your allowlist excludes.
2. Rescope old keys. List every knowledge base service API key, reissue each integration key bound to the one knowledge base it needs, and revoke the workspace-wide originals.
3. Inventory tools that act. List every custom tool, HTTP Request node, MCP server and Skill that writes, sends, pays or deletes, and note which apps and agents can call each one.
4. Route MCP and HTTP through the gateway. Point Dify's MCP tool connections at the AgentShield MCP gateway and your HTTP tools at the AgentShield proxy. Move long-lived write credentials to the gateway so the sandbox never holds them.
5. Write policy per tool. Allow reads broadly, cap writes by value, deny what an agent should never touch. Rules live in AI agent permissions management and apply the same way to workflows, chatflows and Dify Agent.
6. Keep Human Input for content review, and move the money decisions. Use the node for drafts and edits. Send payouts, refunds and record changes to a gateway hold where a logged-in, named approver signs off, and every decision lands in the AI agent audit trail.

Teams comparing visual builders should read our Flowise security and n8n security pages too, since the same gateway policy covers all three. Teams whose business users build agents inside a workspace tool should also read our Notion Custom Agents security page.