Oktapod runs as a service on a Mac, Linux, or Windows machine you control. There is no Oktapod cloud that holds your agent, and no Oktapod account.
It asks before risk.
It shows its work.
Oktapod is an agent that reads your mail, works in your apps, and runs while you are away. That only works if its limits are real. This page explains where it runs, how it decides what may happen, what we tested, and what it does not protect against.
Where it runs
A computer you controlDeveloper telemetry
Off unless you turn it onApprovals
No global off switchReport a vulnerability
security@oktapod.aiYour agent lives on your machine.
Conversations, memory, schedules, approvals, run records, files, and credentials stay in Oktapod's data folder. Messages and relevant context go to the AI provider you connect; with a local model they stay on your hardware.
The web app listens on this computer only. Other devices connect through your own private network or a pairing flow that never copies the master key.
An installed Oktapod sends no prompts, logs, metrics, or errors to its developer. Monitoring stays off until you enable it and choose where it goes.
Every action is judged by its effect.
Before anything runs, Oktapod's own policy asks what it touches, how far it reaches, whether it can be undone, and how many things it affects. A tool's name or a claim that it is "read-only" is not trusted. Each decision lands in one of four lanes and is recorded.
Silent
Runs without a prompt: reading, searching, computing, keeping cited notes.
Report
Runs, then shows you the evidence of what changed.
Hold
Waits through a cancellation window before it runs, so you can still stop it.
Ask
Waits until a signed-in person approves or denies it.
-
Unknown
An unrecognised tool or an unclear scope is blocked or sent to Ask. It is never guessed safe.
Some actions always need a person, even with a saved permission: moving money, reaching many people or things at once, destructive actions that cannot be undone, and messages without exactly one clear recipient. Nothing said in chat removes that floor.
A person stays in the loop.
-
Exact
An approval is tied to the recipient, target, and content you saw. Approving "send this note to Sam" can never become permission to send different text, or to send it to someone else.
Single-use
Allow once runs one action, once. A denial is final.
-
Narrow when widened
For trusted work you can approve a coding workspace for today, or one app for a window you choose. Grants, fuses, and holds are each limited to one effect and resource, and each can expire or be revoked.
-
No borrowed permission
Schedules and helper agents never inherit approval from your current chat. They are safe on their own, use a permission set up for them, or ask.
Least privilege, by construction.
Keys, passwords, and tokens are stored in files only your user can read. They are never shown back in chat, and revealing or sending a secret is itself an action that asks every time.
If you use Oktapod-hosted Google or Microsoft sign-in, tokens are encrypted so only your installation can read them, held for a few minutes until it collects them, and never stored readable.
A paired device can never widen its own permissions. Computer control needs your approval at pairing and the operating system's own permissions; screenshots are short-lived files kept for the model only.
Each app connection uses the narrowest access the provider offers. A connected app does not grant Oktapod permission to act; policy and approvals still decide.
Untrusted content stays data.
An agent that reads email and web pages will read instructions written by someone else. Oktapod treats every retrieved document, tool result, and observed page as untrusted input, and layers its defences so one failure does not become an action.
-
Instructions are not authority
Text inside an email, web page, or file cannot approve an action, change a permission, or claim to speak for you.
-
Memory cannot grant permission
A message claiming future authority, such as "you may always send my files", is not saved as policy. Our August 2026 red team found this path open; it was fixed, regression-tested, and retested live.
-
Isolated computation
Calculations that run automatically use an isolated container with networking off and a read-only workspace. If that isolation is unavailable, they do not run automatically.
-
Outbound control
Web reads block private addresses and unsafe redirects. You can also route all outbound traffic through a policy proxy you operate, with no direct fallback.
-
Approvals are not a sandbox
Approvals decide whether an action is allowed; they do not physically contain a program. For stronger isolation, pair them with sandboxes, scoped credentials, and firewall rules.
Every side effect leaves a receipt.
-
Input to outcome
Each action keeps the chain of what was requested, why it was allowed, what ran, and what changed. Mutations are idempotent, so a retry cannot send the same message twice.
-
Ask why
oktapod decision <run_id>oktapod timeline <run_id> -
Safe updates
Downloads publish SHA-256 checksums. Updates back up first, verify health after, and roll back when verification fails. How updates work.
What we tested, and what we found.
Approval binding, pairing and remote trust, secret custody and redaction, OAuth replay, sandbox filesystem and environment, idempotency, and release tamper and rollback.
Hidden instructions in email, code comments, translations, tickets, and JSON. No secret disclosed and no external action taken.
Fake executives, spoofed approvals, and swapped recipients were stopped. One high-severity memory poisoning breach was found, fixed, and retested.
These results cover named attack classes at a specific revision, August 2026. They reduce uncertainty; they do not remove risk. We publish failures alongside passes.
What it does not protect against.
-
Your machine
Anyone who can change the Oktapod computer, its database, or its credentials is trusted by design. Protect that machine like the accounts Oktapod can reach.
-
Your providers
The AI provider and the apps you connect receive what they need to do the work, under their own terms. Choose a local model to keep model requests on your hardware.
-
What you approve
Oktapod shows exactly what will happen before it asks. An approved action still runs.
Report a vulnerability.
Email security@oktapod.ai with the subject “Oktapod security report”. Please do not disclose an unpatched issue in a public issue or post. We confirm receipt, assess impact, and coordinate a fix and disclosure with you.
-
Most relevant
Authentication, approval bypass, cross-scope retrieval, credential disclosure, prompt injection that causes an external action, unsafe plugin execution, and update or restore integrity.
-
Include
The release, platform, reproduction steps, and impact. Remove real credentials, messages, and database contents. Test only against your own installation.
-
Fixes
Security fixes ship to the latest stable release. There is no paid bounty or response-time guarantee today.