AMD Ships GAIA 0.23, Adding Terminal-Native Agent Installs and MCP Security Hardening for Ryzen AI NPUs
AMD's open-source local AI agent framework for Ryzen AI NPUs gains a terminal-native agent hub, cross-surface confirmation gates, and MCP security fixes.
Overview
AMD released version 0.23 of GAIA, its open-source framework for running AI agents locally on Ryzen AI hardware, on August 13, 2026, according to the GitHub release notes. The update adds a terminal-native way to install and manage agents and closes off several ways a misbehaving or malicious agent could reach outside its sandbox, continuing a release cadence that Phoronix described as improving both features and security in the same update.
What We Know
GAIA is described in its own repository as “AMD’s open-source framework for building intelligent AI agents that run 100% locally on AMD Ryzen AI hardware,” using “hardware-accelerated inference using NPU + iGPU on AMD Ryzen AI processors.” The project lists the AMD Ryzen AI 300-series as its minimum supported hardware and the Ryzen AI Max+ 395 as the recommended chip. According to Phoronix, GAIA is built atop AMD’s Lemonade SDK and has been used as an AI companion for email management and as a Bash coding agent, among other agent skills.
Before version 0.23, installing a new AI agent in GAIA required either the graphical app or manual Python pip commands, Phoronix reported. The new release adds a gaia hub command that, according to the release notes, “browses, installs (behind a trust prompt for unverified agents), runs, and removes agents without leaving the shell.” Phoronix specifically cited gaia hub list for browsing the agent catalog and gaia hub install for installing an agent from the command line. The release also introduces a gaia skill command set that the release notes say “makes skills first-class: create, import, sign with trust tiers, and audit them before sharing.” The notes add: “They’re opt-in — you add the ones you want.”
On security, the release notes state that “the local API and MCP bridge no longer expose themselves to the network by default” and that “the confirmation prompt that pauses an agent before it sends mail, writes a file, or runs a command now works from the terminal and over the local API and MCP — not just inside the graphical app.” More specifically, AMD says “the MCP bridge binds to localhost, the local API refuses credentialed cross-origin requests from arbitrary sites, MCP servers launch without a shell, and an agent can’t write into ~/.gaia or reach the database with crafted SQL.” The release also changes how GAIA connects to Microsoft accounts: the notes say a Microsoft sign-in is “now an explicit Personal-or-Work/School choice with a zero-setup sign-in,” replacing a single connector that previously had to guess the account type.
GAIA 0.23 is built on version 11.5 of the Lemonade SDK, Phoronix reported, and is available for Windows, Linux, and macOS via GitHub.
What We Don’t Know
AMD’s release notes and Phoronix’s coverage do not specify how many agents or skills are currently available in the GAIA hub catalog, nor do they detail performance figures for NPU-accelerated inference under the new release. Neither source specifies exactly how the trust-tier signing system for skills is implemented or verified.
Analysis
The update lands as AMD continues pushing developer tooling for its Ryzen AI NPUs as a local, offline alternative to cloud-hosted AI agents — the project’s own framing emphasizes that data “stays on your machine” with no API fees or subscriptions, per its GitHub README. Moving agent installation into the terminal and hardening the MCP bridge and local API against network exposure addresses a class of risk that has drawn scrutiny across the broader AI-agent tooling ecosystem this year, as autonomous agents increasingly gain the ability to send messages, write files, and execute commands with only limited human oversight.