Open WebUI changes agent defaults

Open WebUI urges administrators to install 0.13.0 for security fixes. Detailed advisories will follow CVE assignment, its release note says. The database migration needs preparation; computer access requires a separately configured Open Terminal connection for the Desktop and Browser tabs.

Before changing versions, back up the database and associated files. The update guide says to stop every replica, let one migrate, then restart the others on the new version. ENABLE_DB_MIGRATIONS=false merely selects the migration runner; it cannot make a mixed‑version fleet safe.

A container‑tag rollback does not undo the migration: keep the pre‑update restore point. Preserve WEBUI_SECRET_KEY across container recreation or existing sessions are invalidated.

The walkthrough leaves sub‑agents off by default, but any enabled deployment needs concurrency, background, iteration and output caps; those now default to unlimited.

Native tool‑call rounds rise from 256 to 1,024 per response. CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS=256 restores the prior cap. Native‑calling models can create private Python tools for users allowed to create workspace tools; disable Tool Creation per model to prevent new tool creation.

Enable Tool Permissions before choosing Ask for approval; Full access runs tool calls immediately.

Open Terminal runs in Docker for isolation or directly on the host. Those are execution choices, distinct from the chat’s permissions.

A shared connection means shared files and running programs, even with a local model. Trusted‑team multi‑user workspaces differ from Enterprise‑licensed per‑user containers.

For uncontrolled sites, the walkthrough recommends Docker, approvals and signing out: hostile page instructions can target local models too. Published Docker images disable Chromium’s own sandbox. Local inference keeps screenshots local; cloud inference sends them to the provider.

Choose the execution and sharing boundary before enabling optional actions. Approval prompts cannot replace a migration backup, and local inference does not establish per‑user isolation.

Archive: two people share a workstation, April 16, 2007; not an Open WebUI deployment. Photo: Lisamarie Babik / Wikimedia Commons, CC BY 2.0. Cropped; no endorsement.