Security

Security & isolation

What actually protects your box, your code, and your key — described against what the system does, not what sounds reassuring. Where a claim was checked with a live probe, we say so.

Per-box isolation

Every box is its own Fly Machine — a hardware-virtualized micro-VM, one per user, one per box. Inside it your agent runs as a de-privileged user, not root: in our live runs it could not even write to / and fell back to its own workspace, exactly as intended.

Cross-tenant traffic is blocked

Your agent cannot reach another tenant's box. Every box carries an always-on kernel rule that drops the agent user's traffic to the provider's private network (the fdaa::/16 range). We verified this with a live two-box probe: an agent on one box could not reach a second box.

The cloud metadata endpoint is always blocked

A kernel rule on every box drops the agent user's access to the cloud metadata endpoint (169.254.169.254) — the address that would otherwise hand out instance identity and secrets. This drop is on in all three egress modes, ahead of any allow rule.

Egress: open by default, restrictable

By default a box's agent has open outbound access to the public internet. This is a deliberate choice — a coding agent needs to install packages, clone repositories, and reach your model provider — and it is not a claim that outbound traffic is filtered. The metadata and cross-tenant blocks above are the guarantees; prepaid credit, per-account box caps, an incident kill-switch, and our Acceptable Use Policy are the backstops against abuse.

If you want a tighter box, set a per-template agent_network policy: allowlist routes the agent's HTTP/HTTPS through a pinned proxy and drops everything else, or none gives the agent no egress at all.

Your provider key

You bring your own model key and it goes to your box, never our database. It is delivered over TLS to the box and stored on the box's own disk by the agent; model traffic goes straight from the box to your provider, so we never see or meter it. Destroying the box erases the disk and the stored key with it. Full detail: Bring your own key.

Accounts and access

• Passwords are stored only as scrypt hashes — never in plain text.
• Sign-in and signup sit behind an OAuth authorization server, with per-IP throttles on sign-in, signup, and password reset to blunt guessing and account enumeration.
• Each box is reachable only through a per-box token; the relay rejects an unknown or revoked token at the WebSocket upgrade, before any socket opens.
• Everything is served over TLS — we run Caddy for it rather than rolling our own.

Billing can't run away

Billing is strictly prepaid. A box needs at least $1.00 of credit to start, your balance cannot go negative, and a zero-balance box suspends. There is no overage bill and no runaway spend.

What we don't pretend

Your box runs the code you and your agent tell it to. We do not sandbox what your agent does inside your box or inspect your code — that box is yours, and you are responsible for what runs on it, under our Acceptable Use Policy. If you spot something being run on OpenAgent that breaks those rules, email support@openagent.example.