SlowMist reports that the NOFXAI automated trading system has been found to have serious vulnerabilities and needs to be upgraded as soon as possible.

SlowMist's security team recently analyzed NOFX AI, an open-source automated futures trading system based on DeepSeek/Qwen, and discovered several serious authentication vulnerabilities. They pointed out that the system has a "zero-authentication" mode in its default configuration, with administrator mode directly enabled, allowing all requests to pass without verification. Attackers can access `/api/exchanges` and obtain the complete API key and private key. While JWT is added in "authorized" mode, the default `jwt_secret` still exists, and if the environment variable is not set, it will revert to the default key. Furthermore, sensitive fields in this mode are still output as raw JSON; if the token is forged or stolen, it will also lead to key leakage. SlowMist stated that as of mid-November, they had identified over a thousand publicly deployed instances using this vulnerable configuration and have coordinated with the Binance and OKX security teams to replace the relevant credentials. The team urges all users to upgrade their systems immediately, especially those running bots on Aster or Hyperliquid, to check their settings as soon as possible.