# Security

Autonomous lets an AI you connect (ChatGPT, Claude, Gemini, Cursor and others) work on this computer: read and write files, run terminal commands, open and script apps, and manage processes. That is the product. You decide how much it can reach when you start it; everything else is enforced by the Autonomous agent on this computer.

## The short version

| You want… | Do this |
|---|---|
| The AI to work on the **computer** with no approval prompts | Run `autonomous`, read the warning, and confirm **Computer + Bypass ON**. |
| The AI to touch **only one project folder** | Start Autonomous inside that folder, then use `/permissions workspace`. |
| To **approve changes before they happen** | Use `/bypass off`. |
| To return to **computer access** | Use `/permissions computer`. |
| To **stop everything immediately** | Press `Ctrl+C` in the Autonomous terminal, or close it. |

## How it works

```
AI client ──HTTPS──► Autonomous backend ──WebSocket──► agent on this computer ──► files / terminal / apps
```

- Your computer only makes an **outgoing** connection. No port is opened and nothing on it is exposed to the internet.
- Autonomous runs with **your user's permissions**, never as administrator/root, and never asks for your password.
- By default it runs only while its terminal is open (`Ctrl+C` stops it). The background service exists only if you install it explicitly with `autonomous autostart`.
- The device credential is stored in `~/.autonomous-mcp/device.json`, readable only by your user, and is never passed to the commands the AI runs.

## Computer

After the startup warning is accepted, Autonomous starts in **Computer** scope with **Bypass ON** for the current session. The AI can access anywhere your user can: documents, downloads, projects, apps and scripts (shell, Python, AppleScript and so on). A short list of system commands (`sudo`, disk formatting, shutdown…) is still refused to prevent accidents.

## Workspace (optional)

Start Autonomous from inside the project folder you want to isolate, then use:

```
/permissions workspace
```

For that session:

- File tools only accept paths inside the folder.
- Terminal commands run in an operating-system sandbox (Seatbelt on macOS, bubblewrap on Linux) that cannot read or write your other files. On Windows, terminal commands are disabled in a workspace.
- Workspace is enforced while Bypass is OFF.
- Turning Bypass ON leaves Workspace and returns to Computer access.
- Use `/permissions computer` if you want Computer access while keeping Bypass OFF.

Only the person at this computer chooses the scope. The AI and the server cannot remotely widen it.

## Bypass

**Bypass ON gives Autonomous greater autonomy and greater risk.**

When Bypass is ON, Autonomous uses Computer access with no per-action approval prompts and no Workspace boundary. If Workspace was active, turning Bypass ON disables it. When Bypass is OFF, actions that can change the computer wait for approval in the Autonomous terminal, and `/permissions workspace` can enforce a folder boundary.

Every interactive start asks the person to confirm **Computer + Bypass ON** before the agent starts. Bypass lasts only for the current session, can be turned off with `/bypass off`, and cannot be enabled remotely by the AI or the server. Choosing `/permissions workspace` turns Bypass OFF automatically.

## Your responsibility

With Computer access the AI can do anything your user can do, and it acts on what it reads, including text in files, web pages or emails. Connect only AI accounts you trust, protect them with two-factor authentication, and remove connections you no longer use at https://auto.octamundi.com. For isolation, run Autonomous in a virtual machine, a container or a separate computer.

## Updates

`autonomous autoupdate` is **off** by default. When on, Autonomous installs the newest npm release before starting. `autonomous update` updates on demand.

## Reporting a vulnerability

Please email **autonomousmcp@gmail.com** with the details and, if possible, steps to reproduce. Do not open a public issue for security problems.