article methodology
Prime Agent security: trust boundaries and the non-sandbox warning
Prime Agent executes model-generated Python, shell commands, skills, and extensions with your OS permissions. Worker and kernel process separation is for lifecycle isolation, not security isolation. Use disposable clones, clean worktrees, and external restricted environments for untrusted code or instructions.
First-party announcement, documentation, release, or installer.
Trust model
Prime Agent is best understood as a local trust boundary expansion, not a security sandbox. The model can steer code, but it does not gain magical confinement around that code.
Kernel and workers
Kernel and worker separation keeps failure domains cleaner, but it does not stop file access, shell access, or credential use within your account.
Installer review
Review the installer if you care about supply-chain risk. The shell-pipe install is convenient, but convenience and strict review are in tension.
Skill and extension trust
Skills, extensions, and packages are trusted code. If you cannot audit them, do not grant them sensitive workspaces or credentials.
Transcripts and secrets
Session exports and transcripts can leak secrets. Redact before sharing, and prefer disposable environments for sensitive projects.
Unresolved questions
- prompt injection persistence,
- trustworthy auto-install boundaries,
- and safe default policies for untrusted repos.