Security

Agentbits gives AI agents real capabilities: editing files, running commands, reaching servers, databases and connected apps. This page explains the security model behind that, where each rule is enforced, and the limits you should know about before you grant access.

Principles

• Deny by default. Agents get access to connections, file attachments, skills and apps only when you grant it, per agent. Access is checked inside Agentbits at the moment of each operation. What an agent’s instructions say is never treated as an access check.
• Approvals for risky actions. Changes on Production connections and app tools set to Ask me first wait for your approval. After you approve, access is checked again; if you lower an agent’s access while a request waits, the request is dropped.
• Untrusted content stays data. File contents, query results, command output, app results and memory notes reach the model wrapped as untrusted data, not as instructions.
• Secrets stay in the main process. They are stored only when the operating system can encrypt them.
• Honest interface. A limit that Agentbits can’t enforce is not shown as enforced. The Browser and Terminal permissions say so in their descriptions.

Your data stays local

Everything (organization, projects, chats, tasks, memory, reports, files, audit log) is stored in a SQLite database on your computer:

System	Data folder
Windows	%APPDATA%\Agentbits
macOS	~/Library/Application Support/Agentbits
Linux	~/.config/Agentbits

You can point Agentbits to another folder with the AGENTBITS_DATA_DIR environment variable. Only one Agentbits window runs per data folder; opening it again brings the existing window to the front.

There is no Agentbits server, no account and no telemetry. Network traffic goes only to:

• the providers you set up, and the Claude Code / Codex CLIs themselves,
• the connections and apps you add,
• GitHub, when you install or update a skill from there,
• the sites you open in the built-in Browser,
• the support page, in your system browser, if you click the support button.

See Settings for backup, restore and reset.

Secrets

API keys, database and SSH passwords, private keys, app environment variables and headers, and OAuth tokens are encrypted with the operating system keychain (Windows DPAPI, macOS Keychain, Linux Secret Service). They are never sent to the interface, prompts, terminals or logs. Secret fields are write-only: a stored value shows as dots and can only be replaced.

If no working keychain is available (for example a Linux system without a Secret Service), Agentbits refuses to store secrets rather than saving them in a weaker form.

Reset everything in Settings → Data management also deletes saved API keys. Backups keep them in encrypted form; on Windows they can only be decrypted again by the same user on the same computer.

What is enforced where

Area	How it is enforced
Files, terminal, network	Through the provider: Claude Code’s tool list and folder limits, Codex’s sandbox. API providers have no file system or terminal at all. See Permissions.
Repository settings	Claude Code runs without the repository’s own .claude settings and hooks and ignores its .mcp.json. Codex’s unrestricted mode is never used.
Servers and databases	Checked by Agentbits on every call: access level, statement classification, Production approval, audit. Agent reads use a read-only database user, so the database itself refuses writes. See Connections.
Apps (MCP)	Agents never connect to an app directly. Every call goes through access checks, the tool’s policy, approvals and the audit log. See Apps.
Skills	Nothing is executed when you install a skill. Agents only see skills assigned to them. See Skills.
File attachments	Agents only read files shared with them; content is treated as data and instruction-like lines are flagged. See Files.
Project folders	Agentbits refuses folders that are too broad (a drive root, your user folder, the Agentbits data folder) and follows links to check the real location.
The app itself	The window runs sandboxed; the built-in Browser gets no device permissions.

Untrusted content and prompt injection

Text that comes from outside (a file, a query result, a command’s output, an email returned by an app) may contain instructions written to mislead an agent. Agentbits marks all of it as untrusted data and tells agents not to follow instructions inside it. Instruction-like lines in files are shown to you as warnings. Skills are different: agents read them as instructions, so the preview flags suspicious lines before you install one. This lowers the risk but can’t guarantee how a model behaves, so keep approvals on for actions that change things.

Honest limits

These are known boundaries, not bugs waiting to be found:

• Terminal means your user’s rights. A Claude Code agent with the Terminal permission can do anything your OS user can. With Terminal and Network, it can also reach servers and databases with credentials stored on your computer (~/.ssh, .pgpass, environment variables), outside the connection checks. There is no OS-level isolation: give these permissions only to agents you trust, or run Agentbits under a restricted OS user.
• The real guarantee for connections is on the server. Statement and command classification is heuristic. Use a separate read-only database account and a restricted SSH user.
• Local apps run as you. A local (stdio) MCP server is a program running with your rights; Agentbits can’t restrict it. Read-only and destructive markings on tools come from the server.
• OAuth sign-in only to servers you trust. Check the address of the sign-in page that opens before entering a password.
• Stopping isn’t instant everywhere. A database query or SSH command that already started finishes within its time limit (30 to 60 seconds). Pausing a CLI agent doesn’t freeze its process.
• Some things are stored in full. Agent terminals keep the full prompts sent to agents until log retention removes them. The audit log has no retention limit; only Reset everything clears it.
• No spending cap. There is no budget, token or total-time limit per task.
• Environment variables pass through to the Claude Code and Codex CLIs as they are (they need them for sign-in, proxy and PATH).
• Packages are unsigned. When installers are published they won’t be code-signed, so Windows SmartScreen will warn you.

An independent security review in October 2026 covered these areas. Most findings are fixed; the rest are partly addressed, documented as limits above, or still open. The full status table is in the repository’s docs/SECURITY.md (in Turkish).

Report a vulnerability

Please don’t open a public issue for security problems. Report privately through GitHub: Report a vulnerability (repository → Security → Report a vulnerability).

Include:

• the Agentbits version (Settings → General shows Agentbits v<version>) and your operating system,
• the provider involved, if any (Claude Code CLI, Codex CLI, Anthropic API, OpenAI API or Demo),
• steps to reproduce, what you expected and what happened,
• the impact as you see it, for example an agent exceeding its permissions, a secret leaving the main process, or a way around approvals or the audit log.

Don’t include real API keys, passwords or personal data.

In scope is anything that lets an agent, a file, a query result, a connected app or a web page do more than you allowed, read secrets, skip approvals or avoid the audit log. Reports showing that the limits above are weaker than described are welcome too.

Agentbits is a one-person project, so responses are best effort. The aim is to acknowledge reports within a week and keep you informed until a fix or decision is published. With your permission, you’ll be credited in the release notes. Only the latest release and the main branch receive security fixes.