Security is a set of defaults, not a feature
An agent is secure because of how it is built, not because of a marketing checkbox. Four things matter most: where the keys live, what the shell can do, what the model is allowed to obey, and whether you can prove what happened.
1. Keys stay out of the agent
The agent should hold a revocable token, never a provider key. That way a compromised agent has nothing of value to leak, and you can revoke a single device without rotating the provider key.
2. The shell is sandboxed
- Argv-based commands, never a raw shell string.
- An allowlist of permitted commands.
- Deletes go to the trash.
- A workspace boundary the agent cannot leave.
3. Prompt injection is blocked
Instructions hidden in web pages, files, or emails are scored and blocked before the model or the tool sees them. The guard sits in front of the model, where it can stop the attack instead of asking the model to ignore it.
4. Everything is recorded
An append-only, hash-chained audit trail means every action, decision, and reason is provable. A normal text log can be edited; a chained log cannot.
The fastest way to test it
$ remoteagent chat "read the disk and list large files"
# watch it plan, call tools, and record every step