letta through 0.16.8 ships a compose.yaml with LETTA_SERVER_SECURE unset, disabling password middleware so all API routes are unauthenticated. Remote attackers can run arbitrary Python via POST /v1/tools/run, manage users via /v1/admin, and execute OS commands through exposed PostgreSQL superuser access using default credentials and COPY PROGRAM. Upgrade past 0.16.8 and enable LETTA_SERVER_SECURE; restrict DB port exposure.