Security status

Security status

Date: 2026-08-01

Target scope: local-first Agentic Sandbox deployments after `v2026.7.20`. This page summarizes public security claims, evidence, and known limitations. It is not a certification report, compliance attestation, or penetration test.

Status terms

StatusMeaning
VerifiedCurrent evidence exists for the target scope.
QualifiedThe capability exists, but public wording must keep explicit boundaries.
Implemented-not-verifiedCode or workflow exists, but release-specific evidence is incomplete.
PlannedArchitecture or issue tracking exists, but implementation is not complete.
Not claimedThe project should not present this as a current capability.

Claim decision table

Claim areaPublic statusCurrent wording boundaryEvidence
Self-hosted, no hosted control planeVerifiedSafe to claim for documented local deployments. Keep deployment modes explicit.Positioning, attack surface inventory
KVM isolationQualifiedSafe to claim as a runtime capability. Do not claim escape-proof isolation or complete host containment.Architecture, `.aiwg/security/security-posture-2026-06-19.md`
Rootless/container runtimeQualifiedSafe to describe as a lighter runtime option, not as equivalent to KVM isolation.Container runtime, attack surface inventory
Persistent sessionsVerifiedSafe to claim persistent agent sessions and restart-oriented reconciliation within documented runtime boundaries.Task run lifecycle, session reconciliation
Agent transport identityQualifiedSafe to claim support for UDS, vsock, and mTLS identity. Do not claim every deployment profile is authenticated unless verified for that release/profile.agent transport CA backends, `.aiwg/architecture/agent-transport-security-sad.md`
Local management API and dashboardQualifiedDefault posture is local-first. Do not claim production-grade remote multi-user admin authentication.API reference, attack surface inventory
Credential records and startup profilesQualifiedSafe to claim metadata-first credential references and write-only credential API behavior.`.aiwg/security/credential-posture-2026-06-19.md`, `.aiwg/architecture/adr/ADR-028-workload-credential-leases-and-startup-profiles.md`
Zero credential exposureNot claimedDo not claim that secrets never enter VMs, containers, files, environment variables, logs, or transcripts. Some tools require scoped file or final-process environment materialization.`.aiwg/security/credential-posture-2026-06-19.md`, attack surface inventory
Credential proxy deliveryQualifiedHTTP/API proxy delivery is implemented for protocols that can target the broker, with lease-bound policy, per-lease/session rate limits, injection, redaction, and deterministic sentinel checks. Do not describe it as universal or as direct-egress bypass prevention without network-policy evidence.credential proxy, `.aiwg/testing/credential-leakage-harness-2026-07-01.md`, `.aiwg/architecture/adr/ADR-028-workload-credential-leases-and-startup-profiles.md`
Managed-container egress isolationQualifiedThe default management-created Docker network is internal/default-deny. Operator-supplied Docker networks are an explicit T0 compatibility posture and carry no Agentic Sandbox egress guarantee.Container runtime boundary, `scripts/verify-container-security.sh`
Managed-container control/workload separationQualifiedThe default managed path uses a unique control UID, UDS peer identity, and capability-free workload UID; no transport key enters the container. This does not protect raw provider tokens deliberately materialized inside the workload.Container runtime boundary, `.aiwg/security/transport-security-verification-2026-07-29.md`, #617
Release checksumsQualifiedReleases may publish checksums, but each release must be verified independently.release verification, release notes, release pipeline audit
Signed artifacts, SBOMs, and container provenanceQualifiedClaim only for releases where signatures, SBOMs, and image digests are attached and independently checked.release verification, release pipeline audit
Standards alignmentQualifiedSafe to discuss alignment work. Do not claim SOC 2, HIPAA, FedRAMP, SLSA level, CIS compliance, or other certification without a real program and evidence.standards alignment, ASVS profile, `.aiwg/security/practices-spec-gap-analysis-2026-06-19.md`
Attack surface managementQualifiedA launch inventory exists, but complete ASM needs a maintained update process and follow-up verification.attack surface inventory

Known limitations

  • The default management plane is local-first. Remote exposure should use a

trusted tunnel, reverse proxy, or other authenticated boundary.

  • The dashboard and HTTP/WebSocket API should not be marketed as a hardened

remote multi-user admin surface.

  • Credential lease materialization is still sensitive. Public docs must avoid

absolute "zero credential exposure" language; current fake-secret absence tests support only qualified claims for implemented proxy/API/profile/ transcript/loadout paths.

  • The default managed Docker network blocks arbitrary public egress. Selective

allowlisting with destination/byte-count audit still requires an external filtering gateway. Operator-supplied networks are outside the enforced default-deny posture.

  • The default container workload is separated from its control identity and

receives no transport key. Do not extend that claim to manually supplied provider credentials, explicit compatibility transports, or direct provider login state. T1 live-credential claims require the supported credential proxy path; raw-material providers should use a VM.

  • Crash-path credential revocation, complete image digest pinning, full remote

dashboard/admin hardening, release artifact signatures/SBOM verification, and broader base-image provenance remain launch evidence items.

  • KVM is the strongest current runtime boundary, but mount flags, sVirt/AppArmor

evidence, and supply-chain inputs still affect the effective security posture.