# Defense-in-Depth Score: Kortix (Suna)

**Repo:** https://github.com/kortix-ai/suna · **Commit:** `52b9ec976258e15c61b7a92166615bd518afa92e` · **Reviewed:** 2026-10-03
**What it is:** Open-source general AI agent / 'AI Management System' with sandboxed browser, shell and files
**Category:** AI Assistants
**Scored configuration:** Self-hosted stack from `kortix self-host start` with the default Daytona sandbox provider, feature flags at platform defaults, and a project created from the starter template (default `kortix` agent, OpenCode permission 'allow', connector policy allow_all).
**Agent surface (default):** code execution yes · filesystem write yes · network egress yes · external credentials yes · persistent memory yes · untrusted input yes · third party extensions yes · sub agents yes · external communication yes

## Score: 3.2 / 10.0 (Minimal)

| # | Criterion | S | C | D | B | Raw | Cap | Score | Confidence |
|---|---|---|---|---|---|---|---|---|---|
| C1 | Identity & least privilege | L2 | L1 | L0 | L1 | 0.28 | C1-SELFESC | **0.25** | High |
| C2 | Approval gates | L3 | L0 | L0 | L1 | 0.28 | C2-POWERBYPASS | **0.25** (alt) | High |
| C3 | Tool & action scoping | L1 | L1 | L0 | L1 | 0.20 | — | **0.20** | High |
| C4 | Code-execution isolation | L3 | L3 | L3 | L1 | 0.65 | — | **0.65** | High |
| C5 | Untrusted input blast radius | L0 | L0 | L0 | L0 | 0.00 | C5-WORSTCASE | **0.00** | High |
| C6 | Memory, context & configuration integrity | L1 | L1 | L2 | L0 | 0.25 | — | **0.25** | High |
| C7 | Third-party extensions | L1 | L1 | L0 | L0 | 0.15 | — | **0.15** | High |
| C8 | Secrets & sensitive-data protection | L4 | L3 | L1 | L3 | 0.72 | G1 | **0.50** (alt) | High |
| C9 | Audit & traceability | L3 | L3 | L2 | L1 | 0.60 | — | **0.60** | High |
| C10 | Limits & kill switch | L1 | L2 | L1 | L1 | 0.33 | — | **0.33** | High |


Kortix runs every session in a remote sandbox and has unusually sophisticated building blocks — server-side connector credentials, hash-bound human approvals, network-enforced secret handles, and an agents-as-principals permission model. But the starter project ships the default agent with every grant set to 'all', tool permission 'allow' and connector approvals off, so a prompt-injected session can read plaintext secrets, act in every connected app and push to the default branch with no human involved. The change-request governance guard is also not tamper-resistant.

## Critical gaps
- The sandbox shell runs with OpenCode permission 'allow' and connector policy defaults to allow_all, so no consequential action crosses an approval gate. (ASI09, ASI02, T10; C2) — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L11); [apps/api/src/connectors/db-deps.ts:890](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/db-deps.ts#L890)
- A hijacked default session combines untrusted web/connector content, plaintext secrets and open egress plus irreversible actions with no human in the loop. (ASI01, LLM01, T6; C5) — [packages/starter/templates/base/harnesses/opencode/tools/scrape_webpage.ts:31](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/tools/scrape_webpage.ts#L31); [packages/starter/templates/base/kortix.yaml:92](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L92); [apps/api/src/secrets/strategy.ts:537](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/secrets/strategy.ts#L537)
- Extensions (OpenCode plugins, MCP servers, marketplace items) run as the sandbox user with the full environment, session token and plaintext secrets. (ASI04, T17, LLM03; C7) — [apps/api/src/platform/providers/daytona.ts:185-198](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L185-L198); [apps/sandbox/Dockerfile:106-107](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/sandbox/Dockerfile#L106-L107)

## Criterion details

### C1 Identity & least privilege — 0.25 (high)

Each session gets its own Kortix token bound to one project and one session, and with the 'agents as principals' model (on by default) an agent's API authority is its kortix.yaml grant intersected with a role ceiling, with member management, project deletion and credential issuance reserved for humans. Connector credentials stay on the server. But the starter agent ships with every grant set to 'all', every process in the sandbox receives the session token and all plaintext project secrets, and the change-request governance guard that protects agent grants is not tamper-resistant, which caps this criterion.

- **S L2:** One session-bound token carries a manifest grant checked deterministically per API action against a role ceiling, but reads and writes share that one credential. — [apps/api/src/iam/agent-principal.ts:92-110](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/iam/agent-principal.ts#L92-L110); [apps/api/src/iam/agent-principal.ts:39-43](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/iam/agent-principal.ts#L39-L43) (verified)
  - *To reach the next level:* No per-tool or per-capability credential split: read and write API actions, git pushes and connector calls all ride the same session token.
- **C L1:** API routes and connector calls pass the grant check, but every sandbox subprocess inherits the token and all plaintext runtime secrets, which are used without any authorization layer. — [apps/api/src/platform/providers/daytona.ts:185-198](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L185-L198); [apps/api/src/secrets/strategy.ts:537](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/secrets/strategy.ts#L537) (verified)
  - *To reach the next level:* Plaintext runtime secrets reach every process in the sandbox and are used outside the authorization layer.
- **D L0:** The starter agent is granted connectors, secrets and kortix_permissions 'all', and its default ceiling is every grantable project action except the three human-only ones. — [packages/starter/templates/base/kortix.yaml:90-94](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L90-L94); [packages/starter/templates/base/kortix.yaml:93](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L93); [apps/api/src/iam/agent-principal.ts:50-52](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/iam/agent-principal.ts#L50-L52) (verified)
  - *To reach the next level:* Default agent grant is 'all'; least privilege requires the operator to narrow kortix.yaml by hand.
- **B L1:** A hijacked starter agent holds write authority over the project (secrets, triggers, connectors, gitops including the default branch) plus every connected SaaS account through 'connectors: all'. — [packages/starter/templates/base/kortix.yaml:90-94](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L90-L94); [packages/starter/templates/base/kortix.yaml:93](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L93); [packages/manifest-schema/src/constants.ts:257](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/manifest-schema/src/constants.ts#L257) (verified)
  - *To reach the next level:* Authority is not confined to one system or to non-destructive writes; connected accounts and project administration are both reachable.
- **Cap:** C1-SELFESC — Self-escalation cap applies: the governance guard protecting agent grants is not tamper-resistant.
- **Notes:** D is L0 because the shipped starter grant is 'all', not because the agent-principal mechanism is opt-in; it is on by default, so G1 does not apply.

### C2 Approval gates — 0.25 (high)

Nothing asks a human before the default agent acts. The starter OpenCode config sets every tool permission to 'allow', so shell, file edits and web access run unprompted, and the connector gateway's policy mode defaults to 'allow_all', so sending email or calling any connected app runs without approval. Kortix does have a well-built approval path for connector calls when a project opts into 'risk' mode: writes require a human, the approval is bound to a hash of the exact arguments, only a signed-in human (never the agent's own session) can approve, and argument-level rules can allow, gate or block. Even then the sandbox shell and its open network bypass the gate entirely.

- **default configuration** (default; raw 0.05, cap C2-POWERBYPASS → 0.05)
  - **S L0:** Default configuration has no approval: OpenCode permission is 'allow' and connector policy defaults to always_run. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L11); [apps/api/src/connectors/policy.ts:377](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/policy.ts#L377) (verified)
    - *To reach the next level:* No per-call human approval for any consequential action in the shipped configuration.
  - **C L0:** The most powerful paths — the sandbox shell, raw network egress and direct git pushes — never cross any approval gate. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:8-11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L8-L11) (verified)
    - *To reach the next level:* Shell and egress are exempt from every gate.
  - **D L0:** Connector approvals are opt-in: default_mode falls back to allow_all in code and in the database default. — [apps/api/src/connectors/db-deps.ts:890](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/db-deps.ts#L890); [packages/db/src/schema/kortix.ts:6226](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/db/src/schema/kortix.ts#L6226) (verified)
    - *To reach the next level:* Approval is opt-in rather than on by default.
  - **B L1:** Connector actions (send email, post, delete in third-party apps) are irreversible, while code changes land on a session branch that git can revert, unless pushed straight to the default branch. — [apps/api/src/connectors/gateway.ts:27-31](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/gateway.ts#L27-L31); [apps/api/src/git-proxy/ref-policy.ts:54](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/git-proxy/ref-policy.ts#L54) (verified)
    - *To reach the next level:* No previews, dry-runs or rate limits on external actions; force pushes are not rejected by the proxy.
- **opt-in connector policy default_mode 'risk'** (alt; raw 0.28, cap C2-POWERBYPASS → 0.25) ← counted
  - **S L3:** Per-call gate on connector writes with argument-level allow/approve/block rules, approvals bound to a SHA-256 digest of the exact arguments, and only a human Supabase session may approve. — [apps/api/src/connectors/policy.ts:313-315](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/policy.ts#L313-L315); [apps/api/src/projects/lib/approval-authority.ts:47-58](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/lib/approval-authority.ts#L47-L58); [apps/api/src/connectors/request-digest.ts:14-18](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/request-digest.ts#L14-L18) (verified)
    - *To reach the next level:* The approver sees a redacted, truncated argument preview rather than the full exact call.
  - **C L0:** The gate covers connector-gateway calls only; the shell, raw HTTP from the sandbox and git pushes are outside it. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L11); [apps/api/src/connectors/gateway.ts:27](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/gateway.ts#L27) (verified)
    - *To reach the next level:* Shell and network egress from the sandbox bypass the connector gate.
  - **D L0:** Risk mode must be selected per project; the shipped default is allow_all. — [apps/api/src/connectors/db-deps.ts:890](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/db-deps.ts#L890) (verified)
    - *To reach the next level:* Not on by default.
  - **B L1:** Gated connector actions still execute irreversibly once approved; the ungated shell path remains. — [apps/api/src/connectors/args-preview.ts:1-3](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/args-preview.ts#L1-L3) (verified)
    - *To reach the next level:* No previews, dry-runs, or rate limits on consequential actions.
- **Cap:** C2-POWERBYPASS — Even in risk mode the sandbox shell, the most powerful path, bypasses the connector gate.

### C3 Tool & action scoping — 0.20 (high)

The default agent's main tools are general-purpose: an unrestricted shell, file editing and web fetching inside the sandbox, and every connected app's full action set. There are a few real in-code bounds — the git proxy keeps a session's pushes on its own branch unless its grant says otherwise, the memory tool checks resolved paths, and connector policies can carry argument conditions — but argument conditions are opt-in, and the starter grant includes the scope that lifts the git branch restriction. Everything is enabled by default.

- **S L1:** Most tools are raw passthrough (shell, generic fetch, Pipedream proxy requests); bounded validation exists only in a few places such as the git ref lane and the memory tool's path containment. — [apps/api/src/git-proxy/ref-policy.ts:171-176](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/git-proxy/ref-policy.ts#L171-L176); [packages/starter/templates/base/harnesses/opencode/tools/memory.ts:19-23](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/tools/memory.ts#L19-L23) (verified)
  - *To reach the next level:* No URL/host allowlists, numeric bounds or narrow replacements for the shell and generic HTTP tools.
- **C L1:** Only a handful of paths validate arguments; connector argument conditions apply only when a policy author writes them. — [apps/api/src/connectors/policy.ts:25-31](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/policy.ts#L25-L31) (verified)
  - *To reach the next level:* Most built-in and connector tools carry no argument validation by default.
- **D L0:** Write, exec and network tools are all enabled by default with permission 'allow', and the starter agent receives all connectors. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L11); [packages/starter/templates/base/kortix.yaml:91](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L91) (verified)
  - *To reach the next level:* Dangerous tools are on by default and not individually reduced for the starter agent.
- **B L1:** Shell is confined to the session sandbox, but connectors reach production SaaS accounts with full action sets. — [packages/starter/templates/base/kortix.yaml:91](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L91); [apps/api/src/connectors/gateway.ts:27-31](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/gateway.ts#L27-L31) (verified)
  - *To reach the next level:* Connector actions are not scoped to a project resource or quantity-bounded.
- **Cap:** none
- **Notes:** D is L0 because every tool ships enabled, not because the few validation mechanisms are opt-in; G1 does not apply.

### C4 Code-execution isolation — 0.65 (high)

All model-driven code runs in a per-session sandbox created on a remote provider (Daytona by default), never on the Kortix server, and there is no fallback to host execution: the provider list only contains remote services and creation fails without a project snapshot. Inside, the agent user has passwordless sudo, the box has unrestricted outbound network, the session token and plaintext project secrets are in its environment, and boxes are never auto-deleted. The paired-computer connector is a documented path that runs commands on a user's own machine.

- **S L3:** Execution happens in a remote provider sandbox (Daytona SDK create, public:false), separate from the control plane; it is not ephemeral and the agent is root-equivalent inside via sudo. — [apps/api/src/platform/providers/daytona.ts:220-233](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L220-L233); [apps/api/src/config.ts:710](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/config.ts#L710) (verified)
  - *To reach the next level:* Boxes are persistent (auto-delete disabled) and root-equivalent inside, so it does not reach the ephemeral kernel-isolated tier.
- **C L3:** Every model-reachable process runs inside the sandbox and only remote providers exist; the opt-in paired-computer connector is the documented exception. — [apps/api/src/platform/providers/index.ts:17-39](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/index.ts#L17-L39); [apps/api/src/platform/providers/daytona.ts:205-215](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L205-L215) (verified)
  - *To reach the next level:* The computer-tunnel connector can run model-requested commands on a paired host outside the sandbox.
- **D L3:** Sandboxing cannot be turned off and there is no host backend, but the image is selected by the project repo (sandbox templates / .kortix/Dockerfile), which the default agent can push to. — [apps/api/src/platform/providers/index.ts:37-38](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/index.ts#L37-L38); [packages/starter/templates/base/kortix.yaml:35-40](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L35-L40) (verified)
  - *To reach the next level:* Sandbox image selection lives in agent-writable project files rather than strictly operator scope.
- **B L1:** Full outbound network with the session token and plaintext runtime secrets in the environment, root via passwordless sudo, and no auto-delete. — [apps/sandbox/Dockerfile:106-107](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/sandbox/Dockerfile#L106-L107); [apps/api/src/platform/providers/daytona.ts:185-198](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L185-L198); [apps/api/src/config.ts:742](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/config.ts#L742) (verified)
  - *To reach the next level:* No egress restriction, secrets present in the sandbox environment, and boxes persist indefinitely.
- **Cap:** none

### C5 Untrusted input blast radius — 0.00 (high)

The default agent reads web pages, search results, connector data such as inboxes, and Slack threads, and nothing in the code distinguishes that content from the user's instructions or restricts what happens after it is read. In the same session it holds every project secret as a plain environment variable, every connected app, unrestricted outbound network and the ability to push to the default branch, all without a human approval. A successful prompt injection can therefore both exfiltrate data and take irreversible actions unattended. Inbound triggers are reasonably fenced (Slack requires linked project members, webhooks are signed, inbound email is off by default).

- **S L0:** No taint tracking, quarantine or approval tied to untrusted content; the only mention is a manifest comment. — searched `rg -n -i 'untrusted|prompt.injection|taint'` in `packages/starter/templates/base apps/kortix-sandbox-agent-server/src/harness` → 2 hits (kortix.yaml:105 is a comment explaining the reflector agent's grant; host-health.ts:85 matches 'uncertainty'. Neither is a control.) (verified)
  - *To reach the next level:* No mechanism limits egress or state changes after untrusted content enters the session.
- **C L0:** Web pages, connector results and chat messages enter context with the same standing as user input. — searched `rg -n -i 'untrusted|prompt.injection'` in `apps/api/src/connectors apps/api/src/projects/session-lifecycle` → 1 hits (share.ts:92 validates a sharing request body; nothing marks connector results or prompts as untrusted.) (verified)
  - *To reach the next level:* Untrusted sources are not distinguished.
- **D L0:** There is no control to be on by default. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L11) (verified)
  - *To reach the next level:* No untrusted-input control exists to enable.
- **B L0:** A hijacked default agent can read plaintext secrets and connected data, send it anywhere over open egress, and send email or push code without a human. — [packages/starter/templates/base/harnesses/opencode/tools/scrape_webpage.ts:31](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/tools/scrape_webpage.ts#L31); [packages/starter/templates/base/kortix.yaml:91-93](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L91-L93); [apps/api/src/connectors/db-deps.ts:890](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/db-deps.ts#L890) (verified)
  - *To reach the next level:* Exfiltration and irreversible actions are both available unattended.
- **Cap:** C5-WORSTCASE — In the default configuration a hijacked session can leak secrets and take irreversible connector and git actions with no human involved.

### C6 Memory, context & configuration integrity — 0.25 (high)

Project memory is plain files under memory/ in the project's git repo, written by a path-checked memory tool and not auto-injected, so every change is a versioned commit that can be inspected and reverted. Agent governance (kortix.yaml agents and triggers) needs a human to merge a change request. But agent prompts, skills, memory and harness config (plugins, MCP servers, tool permissions) are not governance keys, the default agent can merge its own change requests, and it can push straight to the default branch, so a poisoned instruction can become permanent shared configuration for every user of the project without review.

- **S L1:** Writes are git commits (logged and versioned) but not validated; the governance guard covers only kortix.yaml agents/triggers. — [apps/api/src/projects/change-request-policy.ts:102](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/change-request-policy.ts#L102); [packages/starter/templates/base/harnesses/opencode/tools/memory.ts:11](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/tools/memory.ts#L11) (verified)
  - *To reach the next level:* No gating of memory, skill, agent-prompt or harness-config writes; the default agent self-merges and can push to the default branch.
- **C L1:** Only the kortix.yaml governance keys are protected, and that protection is not tamper-resistant. — [apps/api/src/projects/routes/change-request-actions.ts:93-94](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/routes/change-request-actions.ts#L93-L94) (verified)
  - *To reach the next level:* Auto-loaded harness files (opencode.jsonc, plugins/, tools/) and agent .md prompts are uncontrolled.
- **D L2:** Memory is namespaced per project repository and in-progress writes sit on a per-session branch; it is shared team-wide by design. — [packages/starter/templates/base/harnesses/opencode/tools/memory.ts:13-16](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/tools/memory.ts#L13-L16) (verified)
  - *To reach the next level:* The default agent can write into the shared default branch directly, so isolation does not hold against the model.
- **B L0:** Merged memory, skills or harness config persist across sessions and users and can steer tool use (plugins and MCP servers load at boot). — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:19](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L19) (verified)
  - *To reach the next level:* Poisoned content persists project-wide without human review; git history allows manual revert only.
- **Cap:** none

### C7 Third-party extensions — 0.15 (high)

Third-party code reaches sessions in two ways: OpenCode plugins, tools and MCP servers declared in the project's harness config, and the marketplace (on by default), which starts an agent session that clones a community item's source and wires it into the project. The marketplace design document promises a lock file with content hashes, but the code says that engine was removed, so nothing is pinned or hash-checked. Extensions run inside the session sandbox as the same user, with the full environment including the session token and plaintext secrets, and the default agent can add them itself and merge or push the change.

- **S L1:** Sources are user- or agent-chosen and unpinned; the hash-lock engine documented in MARKETPLACE.md was removed from the code. — [apps/api/src/projects/routes/marketplace-install-session.ts:8-9](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/routes/marketplace-install-session.ts#L8-L9); [packages/registry/MARKETPLACE.md:7](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/registry/MARKETPLACE.md#L7) (verified)
  - *To reach the next level:* No version pinning or integrity check for marketplace items, plugins or MCP servers.
- **C L1:** The project's own bun lockfile pins the config dir's npm deps, but marketplace items, MCP servers and plugin packages are unverified. — [apps/kortix-sandbox-agent-server/src/harness/open-code/assets.ts:190-195](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/kortix-sandbox-agent-server/src/harness/open-code/assets.ts#L190-L195) (verified)
  - *To reach the next level:* Most extension types carry no verification.
- **D L0:** Marketplace is on by default and harness files in the project repo, which the default agent can write and push, add plugins and MCP servers with no consent prompt. — [apps/api/src/feature-flags/registry.ts:130-131](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/feature-flags/registry.ts#L130-L131); [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:19-20](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L19-L20) (verified)
  - *To reach the next level:* Workspace (project repo) files can add extensions without a consent step showing what will run.
- **B L0:** Plugins run in-process in OpenCode and MCP/stdio servers as the same sandbox user with the full environment, token and secrets. — [apps/api/src/platform/providers/daytona.ts:185-198](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/platform/providers/daytona.ts#L185-L198); [apps/sandbox/Dockerfile:106-107](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/sandbox/Dockerfile#L106-L107) (verified)
  - *To reach the next level:* No per-extension process, scrubbed environment or credentials.
- **Cap:** none
- **Notes:** D is L0 because extensions can be added without consent by default (consent, not an opt-in control); G1 does not apply.

### C8 Secrets & sensitive-data protection — 0.50 (high)

Secrets are stored encrypted and connector credentials and (by default) LLM provider keys never enter the sandbox. Kortix also offers a strong per-secret option where the sandbox holds only a handle and a proxy substitutes the real value on approved hosts. But a new secret defaults to plain environment-variable delivery, and the starter agent is granted every secret, so the model can read them directly. Telemetry is off unless a Sentry DSN is set and excludes PII; argument previews and audit summaries are redacted.

- **default configuration** (default; raw 0.45 → 0.45)
  - **S L2:** Encrypted-at-rest storage, server-side connector credentials and log/audit redaction, but default 'runtime' secrets are placed in the model-reachable environment as plaintext. — [packages/db/src/schema/kortix.ts:873](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/db/src/schema/kortix.ts#L873); [apps/api/src/shared/opencode-audit-ingestion.ts:15-16](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/shared/opencode-audit-ingestion.ts#L15-L16); [apps/api/src/connectors/gateway.ts:29](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/gateway.ts#L29) (verified)
    - *To reach the next level:* Default-delivered secrets are not kept out of model context; redaction does not cover the sandbox environment.
  - **C L2:** Logs, audit rows and approval previews are redacted, but model-reachable sandbox env and subprocess environments carry plaintext secrets. — [apps/api/src/connectors/args-preview.ts:14-20](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/args-preview.ts#L14-L20); [apps/api/src/projects/lib/session-sandbox-env-build.ts:331](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/lib/session-sandbox-env-build.ts#L331) (verified)
    - *To reach the next level:* Subprocess environments and model-bound context are unprotected for default secrets.
  - **D L2:** Error telemetry initialises only when a DSN is configured and sends no default PII; secrets still default to environment delivery. — [apps/api/src/lib/sentry.ts:118-128](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/lib/sentry.ts#L118-L128); [apps/api/src/feature-flags/registry.ts:262](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/feature-flags/registry.ts#L262) (verified)
    - *To reach the next level:* Redaction of default-delivered secrets is not always on.
  - **B L1:** Long-lived project secrets, all granted to the starter agent, are readable inside the sandbox. — [packages/starter/templates/base/kortix.yaml:92](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/kortix.yaml#L92); [apps/api/src/secrets/strategy.ts:537](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/secrets/strategy.ts#L537) (verified)
    - *To reach the next level:* Secrets are long-lived and broadly granted rather than scoped and short-lived.
- **per-secret network-enforced (egress handle) delivery** (alt; raw 0.72, cap G1 → 0.50) ← counted
  - **S L4:** The sandbox gets a handle; the real value is substituted outside the guest only for listed HTTPS hosts and echoed values are redacted. — [apps/kortix-sandbox-agent-server/src/services/egress-shim/rules.ts:24-30](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/kortix-sandbox-agent-server/src/services/egress-shim/rules.ts#L24-L30); [apps/api/src/projects/secret-capabilities.ts:33-49](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/secret-capabilities.ts#L33-L49) (verified)
  - **C L3:** Covers env, model context, logs and subprocesses for each enforced secret; reflection scrubbing is best-effort. — [apps/api/src/projects/secret-capabilities.ts:71-72](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/secret-capabilities.ts#L71-L72) (verified)
    - *To reach the next level:* Reflected credentials are only scrubbed on a best-effort basis.
  - **D L1:** The option is enabled by flag but each secret defaults to environment delivery; agent sessions cannot downgrade an enforced secret. — [apps/api/src/feature-flags/registry.ts:262](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/feature-flags/registry.ts#L262); [apps/api/src/projects/routes/secrets.ts:604](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/routes/secrets.ts#L604) (verified)
    - *To reach the next level:* Must be chosen per secret; the default is plaintext env.
  - **B L3:** A leaked handle is worthless off the approved hosts; the real value stays server-side. — [apps/api/src/projects/secret-capabilities.ts:35-40](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/secret-capabilities.ts#L35-L40) (verified)
    - *To reach the next level:* The underlying credential is still long-lived.
- **Cap:** G1 — Opt-in mechanism: off in the scored default configuration.

### C9 Audit & traceability — 0.60 (high)

Kortix keeps a structured audit log in its own database: API actions, connector calls (with approval status and an argument digest), and OpenCode tool events relayed from each sandbox, each tagged with actor type, agent, on-behalf-of human and delegation depth. That is a solid record for reconstructing who did what. The limits are durability and trust in the in-sandbox feed: rows are buffered in memory and the oldest are dropped under overload, and the tool-event relay runs inside a sandbox where the agent has root.

- **S L3:** Structured audit rows with actor type, agent name, on-behalf-of user and delegation depth; no hash chain. — [apps/api/src/shared/audit.ts:46-54](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/shared/audit.ts#L46-L54) (verified)
  - *To reach the next level:* Rows are not tamper-evident (no hash chain or signing).
- **C L3:** Connector calls including denied and pending_approval outcomes, API actions, and in-sandbox tool events via the OpenCode relay are recorded. — [apps/api/src/connectors/gateway.ts:119](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/connectors/gateway.ts#L119); [apps/api/src/shared/opencode-audit-ingestion.ts:13](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/shared/opencode-audit-ingestion.ts#L13) (verified)
  - *To reach the next level:* Memory writes and credential use inside the sandbox are not separately recorded.
- **D L2:** On by default and stored off the sandbox, but in-sandbox tool events originate from a daemon in a box where the agent has passwordless sudo. — [apps/sandbox/Dockerfile:107](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/sandbox/Dockerfile#L107) (verified)
  - *To reach the next level:* The tool-call feed is produced by a component the agent can control.
- **B L1:** Writes are async, best-effort, and the bounded queue drops the oldest rows on overflow. — [apps/api/src/shared/audit-queue.ts:13-14](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/shared/audit-queue.ts#L13-L14) (verified)
  - *To reach the next level:* Records are not durable per action and can be dropped.
- **Cap:** none

### C10 Limits & kill switch — 0.33 (high)

Runaway sessions are bounded mainly by wall-clock: each observed turn gets a 4-hour renewable grant and an absolute 24-hour ceiling enforced by the control plane, and stopping a session stops the whole provider sandbox, which kills everything inside it. There is no step cap in the starter agent, and LLM spend budgets exist only if an operator sets them. Agents can start other sessions, which get their own limits, and triggers or reminders keep running after a single session is stopped.

- **S L1:** Wall-clock turn limits and a box-level stop exist, but there is no iteration cap and cost caps are operator-configured. — [apps/api/src/projects/sandbox-deadline-policy.ts:52](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/sandbox-deadline-policy.ts#L52); [apps/api/src/projects/sandbox-deadline-policy.ts:93](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/sandbox-deadline-policy.ts#L93); [apps/api/src/llm-gateway/budgets.ts:10](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/llm-gateway/budgets.ts#L10) (verified)
  - *To reach the next level:* No step/iteration cap and no default token or cost cap.
- **C L2:** Limits apply per session box, covering the loop and its in-box sub-agents and processes; child sessions started by the agent get fresh limits. — [packages/starter/templates/base/harnesses/opencode/opencode.jsonc:18](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/packages/starter/templates/base/harnesses/opencode/opencode.jsonc#L18); [apps/api/src/iam/agent-principal.ts:164-165](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/iam/agent-principal.ts#L164-L165) (verified)
  - *To reach the next level:* Child sessions do not count against the parent's budget.
- **D L1:** Defaults are large: 4-hour renewable turn grants up to 24 hours. — [apps/api/src/projects/sandbox-deadline-policy.ts:93](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/sandbox-deadline-policy.ts#L93) (verified)
  - *To reach the next level:* Default ceilings are very large and there is no default spend cap.
- **B L1:** Stop kills the provider box, but child sessions, triggers and server-side connector calls continue. — [apps/api/src/projects/session-lifecycle/stop.ts:154](https://github.com/kortix-ai/suna/blob/52b9ec976258e15c61b7a92166615bd518afa92e/apps/api/src/projects/session-lifecycle/stop.ts#L154) (verified)
  - *To reach the next level:* Stopping one session does not stop sessions or scheduled work it spawned.
- **Cap:** none

## Rule-of-Two check
[A] untrusted input: scrape_webpage / web_search tools and connector results (packages/starter/templates/base/harnesses/opencode/tools/scrape_webpage.ts:31) · [B] sensitive data/systems: all project secrets as plaintext env and all connectors granted (packages/starter/templates/base/kortix.yaml:91-93; apps/api/src/secrets/strategy.ts:537) · [C] state change / egress: unrestricted sandbox egress (no network policy in apps/api/src/platform/providers/daytona.ts:220-233), connector writes under allow_all (apps/api/src/connectors/db-deps.ts:890), git push to default branch · Same default session? Yes

## Highest-impact improvements
1. Narrow agent-session git and configuration authority so grant changes always need a human merge. — C1 D L0→L2, +0.100 before caps (Playbook 4)
2. Ship the starter project with connector policy default_mode 'risk' instead of allow_all. — C2 D L0→L2, +0.100 before caps (Playbook 5)
3. Make 'egress' (handle) the default delivery strategy for new secrets so plaintext never enters the sandbox by default. — C8 S L2→L3, +0.075 before caps (Playbook 4)
4. Narrow the starter agent's grant (no secrets/connectors 'all', no gitops.ref.any or gitops.merge) and require explicit widening. — C1 B L1→L2, +0.050 before caps (Playbook 4)
5. Apply a default egress allowlist to session sandboxes (Daytona network policy) so a hijacked session has no arbitrary outbound channel. — C4 B L1→L2, +0.050 before caps (Playbook 3)

## Re-audit log
- No changes.

## Limitations
- Static source review of the pinned commit only; nothing was executed, installed, or probed.
- The isolation properties of the Daytona, E2B and Platinum sandbox providers are external services and were not verifiable from this repository; C4 relies on how Kortix calls them.
- The OpenCode runtime (third-party) was not reviewed; its permission and plugin behaviour is taken from the shipped opencode.jsonc and its documented semantics.
- Kortix Cloud (managed hosting), the desktop/mobile apps, and non-default feature flags (pi harness, monitors, apps, agentmail email) were not scored.
- This is a very large monorepo; review focused on the API authorization, connector gateway, secrets, git proxy, sandbox provisioning and starter template paths.
- Documentation/code mismatch noted: packages/registry/MARKETPLACE.md describes a content-hash lock that marketplace-install-session.ts says was removed.
- No reviewer-directed prompt-injection text was found in the repository.