security

Read this before you deploy

AgentSilo is security-sensitive software. This page states what it protects against, what it does not, and the rules the system enforces.

Scope, honestly stated. AgentSilo is defence in depth, not a substitute for host patching or an independent VM/microVM boundary for high-risk workloads. It is an actively tested implementation — but deploy it only after reviewing its operational requirements and residual risks.

Trusted components

The security model treats these as trusted:

  • The Ubuntu host kernel and operating system.
  • The local operator account.
  • AgentSilo's narrow privileged workspace service.
  • The policy/proxy services and explicit operator decisions.

Untrusted components

Everything below is assumed hostile:

  • The AI agent and all commands it runs.
  • Agent-generated code and installed dependencies.
  • Browser content, extensions, and downloads.
  • Every process in a silo, and every process running as the agentsilo host identity.

Required boundaries

Compromise of a silo must not automatically grant access to:

  • Human home directories, browser profiles, cookies, password managers, SSH keys.
  • Wayland, D-Bus sessions, or session sockets.
  • sudo, root, Docker, or privileged Podman access.
  • Arbitrary host filesystem paths, container mounts, images, or commands.
  • Network destinations that are not allowed by the silo policy.

The container is defence in depth. The separate unprivileged agentsilo host identity is the primary local separation boundary — not the container itself.

enforced rules

Non-negotiables

These are implemented and tested, not aspirations:

// never

Privileged or root-adjacent silos

A silo never runs as privileged, and the agentsilo identity never gets sudo. Docker or privileged Podman sockets are never exposed into a silo.

// never

Your files, sessions, or credentials

Human home directories, session sockets, browser profiles, or personal credentials are never mounted into a silo.

// never

User-supplied runtime arguments

Arbitrary Podman arguments, container images, mounts, commands, and environment names are rejected. The image catalog is fixed and server-owned.

// always

Fail closed, audit everything

When policy, state persistence, or runtime validation is unavailable, the system fails closed. Network approvals are scoped, timed, single-use, replay-resistant, and durably audited.

residual risks

Know what you're relying on

Silo browser is agent-visible. Treat anything typed into a silo browser as visible to the agent. Use the allowlist deliberately.
Secrets. Supported credentials are injected as rootless Podman secrets at runtime only. Secret values are never stored in silo state or returned by manager APIs — but AgentSilo is not a credential vault.
Local client authentication. The desktop client assumes a locally trusted desktop. Operator authentication for exposure beyond that is on the roadmap.
Platform scope. Linux (Ubuntu 26.04 amd64) is the supported runtime platform. The Windows desktop client is the operator shell; silos run on your Linux host.