Security

Atomic Agent runs shell commands, edits files and drives a browser on your machine. That is what makes it useful, and it is why it asks before it acts. This page explains how the agent protects you, in plain words, and how to tell us about a security problem. The code is open source, so you can check every line below yourself.

Report a vulnerability

Please do not post security problems in a public issue or on Discord. Report them privately:

• GitHub (preferred): Report a vulnerability. Only the maintainers see the report.
• E-mail: support@atomicbot.ai, with SECURITY at the start of the subject.

We confirm a report within 3 business days and credit you in the advisory once a fix ships. Scope, timelines and safe harbor are in our security policy. Machine-readable contacts are in security.txt.

1. The agent asks before it acts

Anything that changes your machine or reaches outside it goes through an approval prompt first: shell commands, file writes and patches, moving files to the Trash, HTTP requests, git pushes, killing processes, skill scripts, tools from MCP servers you have not trusted, sending e-mail or opening GitHub issues, and browser clicks that submit, post or delete. The prompt shows what will run and why, and you answer:

• Allow once. Only this call.
• Allow in this chat. Calls of the same kind stop asking until the chat ends. Nothing is saved.
• Always allow. Saves a rule for this project, for example Always allow "git status" in this project. You can see and remove saved rules in the desktop app under Settings › Privacy.
• Deny. The agent is told no, and the same call is not put to you again in that turn.

Out of the box the agent runs at the strictest of five approval levels, so every one of these actions asks. You can loosen it on purpose, and the level you pick is yours, not the model's: a project folder cannot grant itself permissions, and the agent cannot quietly raise its own level, because changing the agent's own settings or keys asks at every level below full trust.

Reading also stays in bounds. A read outside the folder you are working in asks first, and so does any read or command that touches the agent's own secrets at every level below full trust (its .env file and config.json). If a command or a file prints a key anyway, the key is masked before the model sees it, so it does not reach a cloud provider or the chat history.

2. Deletes go to the Trash

When the agent removes files with its own tool, they go to the macOS Trash or the Windows Recycle Bin, not into nothing, and the move asks first. If you change your mind, restore them from the Trash as usual.

Overwrites are covered too. Before the agent replaces a file it did not create in this session, it keeps a copy of the old version (the last 20 copies per folder, files up to 5 MB), and it can put the old version back.

3. Dangerous commands always ask

Some commands can wipe work in one line. These are treated as their own kind of action and ask every single time, even if you allowed shell commands for the whole chat:

• rm -rf, find -delete, git clean -fdx
• git reset --hard, git checkout -- ., git branch -D, force pushes
• sudo, chmod 777, bash -c, eval and similar

An "Always allow" rule is never saved for them, and approving a multi-agent Fusion run does not let its workers run them. Only the top approval level, full trust, skips the question, and you have to choose that yourself.

The same goes for passwords and payments in the browser: typing into a password, one-time code or card field, and any click that pays, asks every time and is never allowed for the whole chat.

4. Telemetry you can see and switch off

The agent sends anonymous usage stats and crash reports by default, so we can see what breaks. They carry a random install id, your OS and CPU type, the app version, the provider and model names, and timing and token counts. They never include your messages, file paths, tool arguments, full URLs, keys or your IP address. The full list of what is sent is in the README.

To turn both off:

• Desktop app: the Privacy switch in Settings.
• Terminal: type /privacy analytics off.
• Config file: set "analytics": { "enabled": false } in config.json.
• Environment: ATOMIC_AGENT_ANALYTICS=off or the standard DO_NOT_TRACK=1 turns them off for that process, whatever the config says.

5. Signed builds and SHA-256 checksums

• macOS: the desktop app and the terminal agent are signed with our Apple Developer ID and notarized by Apple.
• Windows: the installer, the app and the terminal agent are code-signed with a DigiCert certificate.
• Linux: the apt and dnf package repository is signed with our packages key (fingerprint 1047 F119 58C6 442D D472 E497 E4C3 D361 FB7F F123), and so are the rpm packages in it, so apt and dnf check what they install and update. The AppImage and the .deb files you download from the releases page are not signed: check them with their SHA-256 checksum instead.
• Checksums: release files on GitHub come with SHA-256 checksums. The install script checks the checksum before it installs anything, and the download page lists the SHA-256 of each desktop file so you can compare it yourself.

To check a download on macOS or Linux, run shasum -a 256 <file>; on Windows, run Get-FileHash <file> in PowerShell. The result should match the value on the download page.

6. What we do not promise

Approvals keep you in the loop, but they are not a sandbox. A command you approve runs with your own user rights, and skills and shell commands can see the agent's environment, including keys in its .env file. Read what a prompt shows before you allow it, keep the approval level as strict as your work allows, and treat the agent's traces and .env as private files.