Skip to content

security-status.md

Latest commit

 

History

History
75 lines (65 loc) · 7.29 KB

security-status.md

File metadata and controls

75 lines (65 loc) · 7.29 KB
Raw

Security status

Date: 2026-08-01

Target scope: local-first Agentic Sandbox deployments after v2026.7.20. This page summarizes public security claims, evidence, and known limitations. It is not a certification report, compliance attestation, or penetration test.

Status terms

Status Meaning
Verified Current evidence exists for the target scope.
Qualified The capability exists, but public wording must keep explicit boundaries.
Implemented-not-verified Code or workflow exists, but release-specific evidence is incomplete.
Planned Architecture or issue tracking exists, but implementation is not complete.
Not claimed The project should not present this as a current capability.

Claim decision table

Claim area Public status Current wording boundary Evidence
Self-hosted, no hosted control plane Verified Safe to claim for documented local deployments. Keep deployment modes explicit. Positioning, attack surface inventory
KVM isolation Qualified Safe to claim as a runtime capability. Do not claim escape-proof isolation or complete host containment. Architecture, .aiwg/security/security-posture-2026-06-19.md
Rootless/container runtime Qualified Safe to describe as a lighter runtime option, not as equivalent to KVM isolation. Container runtime, attack surface inventory
Persistent sessions Verified Safe to claim persistent agent sessions and restart-oriented reconciliation within documented runtime boundaries. Task run lifecycle, session reconciliation
Agent transport identity Qualified Safe to claim support for UDS, vsock, and mTLS identity. Do not claim every deployment profile is authenticated unless verified for that release/profile. agent transport CA backends, .aiwg/architecture/agent-transport-security-sad.md
Local management API and dashboard Qualified Default posture is local-first. Do not claim production-grade remote multi-user admin authentication. API reference, attack surface inventory
Credential records and startup profiles Qualified Safe to claim metadata-first credential references and write-only credential API behavior. .aiwg/security/credential-posture-2026-06-19.md, .aiwg/architecture/adr/ADR-028-workload-credential-leases-and-startup-profiles.md
Zero credential exposure Not claimed Do not claim that secrets never enter VMs, containers, files, environment variables, logs, or transcripts. Some tools require scoped file or final-process environment materialization. .aiwg/security/credential-posture-2026-06-19.md, attack surface inventory
Credential proxy delivery Qualified HTTP/API proxy delivery is implemented for protocols that can target the broker, with lease-bound policy, per-lease/session rate limits, injection, redaction, and deterministic sentinel checks. Do not describe it as universal or as direct-egress bypass prevention without network-policy evidence. credential proxy, .aiwg/testing/credential-leakage-harness-2026-07-01.md, .aiwg/architecture/adr/ADR-028-workload-credential-leases-and-startup-profiles.md
Managed-container egress isolation Qualified The default management-created Docker network is internal/default-deny. Operator-supplied Docker networks are an explicit T0 compatibility posture and carry no Agentic Sandbox egress guarantee. Container runtime boundary, scripts/verify-container-security.sh
Managed-container control/workload separation Qualified The default managed path uses a unique control UID, UDS peer identity, and capability-free workload UID; no transport key enters the container. This does not protect raw provider tokens deliberately materialized inside the workload. Container runtime boundary, .aiwg/security/transport-security-verification-2026-07-29.md, #617
Release checksums Qualified Releases may publish checksums, but each release must be verified independently. release verification, release notes, release pipeline audit
Signed artifacts, SBOMs, and container provenance Qualified Claim only for releases where signatures, SBOMs, and image digests are attached and independently checked. release verification, release pipeline audit
Standards alignment Qualified Safe to discuss alignment work. Do not claim SOC 2, HIPAA, FedRAMP, SLSA level, CIS compliance, or other certification without a real program and evidence. standards alignment, ASVS profile, .aiwg/security/practices-spec-gap-analysis-2026-06-19.md
Attack surface management Qualified A launch inventory exists, but complete ASM needs a maintained update process and follow-up verification. attack surface inventory

Known limitations

  • The default management plane is local-first. Remote exposure should use a trusted tunnel, reverse proxy, or other authenticated boundary.
  • The dashboard and HTTP/WebSocket API should not be marketed as a hardened remote multi-user admin surface.
  • Credential lease materialization is still sensitive. Public docs must avoid absolute "zero credential exposure" language; current fake-secret absence tests support only qualified claims for implemented proxy/API/profile/ transcript/loadout paths.
  • The default managed Docker network blocks arbitrary public egress. Selective allowlisting with destination/byte-count audit still requires an external filtering gateway. Operator-supplied networks are outside the enforced default-deny posture.
  • The default container workload is separated from its control identity and receives no transport key. Do not extend that claim to manually supplied provider credentials, explicit compatibility transports, or direct provider login state. T1 live-credential claims require the supported credential proxy path; raw-material providers should use a VM.
  • Crash-path credential revocation, complete image digest pinning, full remote dashboard/admin hardening, release artifact signatures/SBOM verification, and broader base-image provenance remain launch evidence items.
  • KVM is the strongest current runtime boundary, but mount flags, sVirt/AppArmor evidence, and supply-chain inputs still affect the effective security posture.

Evidence links