Security Model

A short overview of Agent OS Exec isolation and trust.

Agent OS Exec runs guest code inside a fully virtualized VM so untrusted code stays contained. At a glance:

• V8 isolate boundary: Guest JavaScript runs in a V8 isolate inside the kernel. It never spawns a real host process, touches the real host filesystem, or opens a real host socket.
• Sidecar enforces: A trusted sidecar owns the kernel, VFS, socket table, and permission policy. Every guest syscall is mediated and checked there, not on the host.
• Executor is untrusted: The code you submit for execution is treated as actively hostile. How it reached the executor never makes it trusted.
• Explicit policy: AgentOs.create() currently defaults permission scopes to "allow" so normal programs run. Set the scopes you need to "deny" or provide rules before executing untrusted code. Resource and timing limits remain bounded by default.

Full reference

The runtime trust boundary is sidecar to executor: host configuration is trusted, while guest code and the packages it loads are untrusted.