Security

The claim

Agenti is auditable, bounded, isolated, and admin-authorised for real targets. It is not "safe". It lets an AI model drive security tools, and it assumes the model can be confused by the data it reads. For that reason the important limits are enforced outside the model.

What it is designed to protect

• Agents stay within a scope an administrator approved.
• Users cannot read each other's runs.
• Stored data is encrypted, and nothing runs until an administrator unlocks it.
• Sensitive administrator actions need a fresh sign-in.
• Actions are logged, so a run can be reviewed afterwards.

What it does not protect against

• A careless or malicious administrator.
• An attacker with root on the machine while the vault is unlocked.
• Anything the approved scope allows. If you approve a range you do not own, Agenti will test it.
• Disruption caused by legitimate testing.
• Flaws in the third-party programs agents use, or in Anthropic's service.

A fuller threat model will be published with the first release.

Reporting a vulnerability

Please do not open a public issue for a security problem. Report it privately through GitHub: github.com/agenti-foss/agenti/security/advisories/new.

Include the version, steps to reproduce and the impact. Redact any real client data or credentials.

We will acknowledge reports and credit you if you wish. A response-time commitment will be published with the first release.