AgentOS Security

AgentOS is released under the Apache License 2.0, as are the extension packs in its registry, its guardrail packs and its skills. Its storage dependency, @framers/sql-storage-adapter, is under the MIT License. The code is public, so the guardrail dispatcher, the tool orchestrator and the sandbox that runs agent-written code can be read and audited.

Security improvements are welcomed through pull requests on GitHub.

The full AgentOS runtime (AgentOS.processRequest) runs the guardrails you register on every request. An input guard reads the request before the model does. An output guard reads the final reply, and the streamed chunks too when it asks for them. Each guard answers allow, flag, sanitize or block. In hold mode (guardrailOutputMode: 'hold') nothing streams to the caller until the output guards have judged the whole reply.

A guard with failClosed set blocks when it throws or times out. A deployment can also name required guards (requiredGuardrails): AgentOS then refuses to start without them, refuses a request when one has gone missing, and runs each one fail-closed with a deadline.

Guardrails are opt-in. AgentOS exports a phrase-list guard (PhraseListGuardrail) for a reviewed list of words, phrases or regular expressions, matched after look-alike letters and invisible characters are normalised; a match blocks or goes to an LLM judge. Six guardrail packs install from npm: PII redaction, ML classifiers, topicality, code safety, grounding and content-policy rewriting. The agent(), gmi() and agency() helpers accept guardrail ids but do not run guards. agency() runs two fixed pattern checks of its own after its hitl handler approves a tool call, an agent's input or the final reply: code-safety looks for destructive commands such as rm -rf / and DROP TABLE, and pii-redaction looks for unredacted Social Security and card numbers. A match overrides the approval. hitl.postApprovalGuardrails picks the checks (both by default), and hitl.guardrailOverride: false turns them off. They are not the guardrail packs. See the Guardrails documentation for configuration.

The PII redaction pack (@framers/agentos-ext-pii-redaction) finds email addresses, phone numbers, card numbers, government IDs, API keys and other identifiers with regular expressions, plus optional NLP, NER-model and LLM-judge tiers for names, places and organisations. On input it replaces what it finds before the request reaches the model, and on output it checks the reply. It fails closed: when detection throws, the text is blocked instead of passed through.

You add the pack to the runtime's extension manifest, and it then covers every request on that runtime. entityTypes picks what it looks for, an allowlist keeps named strings in place, and redactionStyle writes each finding as a placeholder, a mask, a hash or a tag.

On the full AgentOS runtime every tool call passes through the tool orchestrator. It refuses a tool named in globalDisabledTools, and it refuses a call when the persona lacks a capability that the tool lists in requiredCapabilities. With hitl.enabled set, a tool marked hasSideEffects waits for a human approval, and the call is refused when no approval manager is configured.

With emergent: true on the full AgentOS runtime, an agent can write a JavaScript tool mid-task. The code has to pass a static check, and an LLM judge reviews the tool before it registers. By default the code runs in a node:vm context inside your process with a 5-second limit. Node's documentation says node:vm is not a security mechanism, and AgentOS measures that code's memory without capping it. Network, file-read and hashing functions reach the code only when you grant them, with an optional domain allowlist for fetch (checked against the first URL's host) and read roots for files. Writing or deleting files also needs a capability ceiling (emergentConfig.capabilities) that grants it.

For a stronger boundary, the QuickJS executor runs each call in a fresh WebAssembly instance with a memory cap. It needs two optional packages, quickjs-emscripten-core and @jitl/quickjs-wasmfile-release-sync.

Injection detection is opt-in. The ML classifiers pack (@framers/agentos-ext-ml-classifiers) scores the request and the final reply for toxicity, prompt injection, NSFW content and threats. By default it flags a category above 0.5 and blocks above 0.8, and each category takes its own thresholds.

The pack scores with the first tier that answers: a local ONNX model (toxic-bert), then an LLM judge if you pass one, then keyword patterns. npm installs @huggingface/transformers with the pack as an optional dependency, and the ONNX model has no prompt-injection label, so whenever that model is available the pack scores injection at 0. The LLM judge and the keyword patterns, which do catch injection, run only when the ONNX model cannot load. For a reviewed list of phrases, use the phrase-list guard described above.

We welcome responsible disclosure of security vulnerabilities from researchers and community members.

• Report a vulnerability privately through the security advisory form on GitHub or by email to [email protected]. Do not open a public issue, pull request or chat message about it.
• A maintainer acknowledges a report within 5 business days and sends an assessment and a plan within 14 days.
• A fix ships before details are published, and the reporter is credited unless they decline. At 90 days from the report an advisory is published with the fix, or with mitigations when no fix exists, unless the reporter and a maintainer agree on a later date.
• In scope: defects in the framerslab/agentos code, including how it handles credentials, files, provider responses and tool results. Out of scope: a flaw that exists only in a third-party provider's service, or only in a deployment's own configuration.