Security

Last updated 26 September 2026 · version 1.3

1. Reporting a vulnerability

Email [email protected] with a description, the version and platform, and steps to reproduce. Please do not include real personal data or secrets. We will:

• acknowledge your report within 3 working days;
• give you an initial assessment within 10 working days;
• keep you informed while we fix it, and aim to release a fix for serious issues within 30 days;
• credit you publicly when it is fixed, if you want us to.

Our machine-readable contact is at /.well-known/security.txt. Where we are required to under the EU Cyber Resilience Act, we notify actively exploited vulnerabilities and severe incidents to the competent authorities within the required time and inform affected users.

2. Safe harbour

If you research in good faith (on your own devices and accounts, without accessing other people’s data, degrading our services, or extorting us) and give us reasonable time to fix an issue before publishing, we consider your research authorised, will not pursue or support legal action against you for it, and will work with you openly.

Out of scope: denial-of-service attacks, social engineering of our staff, physical attacks, spam, and reports from automated scanners with no demonstrated impact.

3. How AgentWarden is built

• Local by design. Everything it watches is analysed on your device. Your code and transcripts are never uploaded.
• Signed everything. The macOS app is signed with our Apple Developer ID and notarised by Apple; Windows releases are code-signed through Microsoft’s Trusted Signing service. Every software update and every detection-rules bundle carries our signature and is refused if it does not verify.
• Read-only unless you say otherwise. It observes; it does not change your security settings. Decoy files and containment exist only if you turn them on. On a judgement call, containment first rehearses on your own machine and pauses nothing until it has earned the right. The one exception is proof: an attack with fresh evidence that this very session carried it into a real action is paused straight away. A pause is reversible, releases itself within five minutes, and never lands on your own terminal, shell or remote access.
• Fails open. If AgentWarden itself fails, your agents keep working. It is never a single point of failure for your work.
• Minimal network surface. The Windows interface listens only on the local machine, with a per-launch secret, strict host and origin checks and a strict content security policy. The phone relay carries only end-to-end encrypted messages.
• Every release says what it contains. Each release carries a list of every file it ships, with its checksum, the exact source version it was built from and what it can do. That list is signed with the same key as our updates, and a release is refused if anything in it disagrees. On your own machine, agentwarden --verify-install checks your installed copy against it. Each release also ships a bill of materials for the few non-PRAESI parts it carries, and a signed record of how it was built.
• Few dependencies. The Windows and Linux client has no third-party runtime dependencies at all, so there is no package supply chain to poison.
• Tested against real attacks. Before each release we replay a red-team suite, including recent real-world attacks on AI agents, through the shipping detection engine on each platform and checks both reach the same verdicts.

4. Supported versions and security updates

• The latest version is the supported version. Security fixes ship as a new release, on macOS and Windows together; we do not patch older versions. AgentWarden checks for updates every 6 hours and, unless you turn it off, installs them itself once your agents have been quiet for ten minutes. Every update is signed, and refused if it does not verify.
• Platforms. macOS 14 or later, and Windows 10 and 11 (64-bit).
• How long. AgentWarden receives security updates until at least 30 September 2031, and for as long as we sell it if that is later.
• End of support. Before we end support for AgentWarden, for a platform or for an operating-system version, we give at least 90 days’ notice in the app and on this page, and keep publishing security fixes until the date given.