Ghosty
Reference

Security

What isolates one agent from another, where your keys live, what an agent can do on a public channel and how an account is deleted.

Updated 2026-09-16

One machine per agent

Each agent runs in its own isolated machine, with its own disk and terminal. Two agents from two accounts share no process, file system or local network. What an agent writes to its disk is seen only by it.

Machines go to sleep when nobody uses them and are destroyed if their owner deletes the agent.

Your keys

  • The provider keys (Claude, OpenAI, DeepSeek) you paste in Credentials are stored encrypted (AES-256-GCM) in your account's vault and only injected into your agents' machines.
  • Connectors (Google, Canva…) store their token under (your user, provider); disconnecting revokes at the provider.
  • An agent's ACP token is shown to you once and can be rotated; the old one dies instantly.
  • Third-party OAuth2 tokens rotate on every refresh; reusing an old one revokes the whole family.

The agent acts as whoever invokes it

An agent can only do what the person who spoke to it could do. In Teams, each turn's tools carry a five-minute credential scoped to that person and that workspace. On a public channel (WhatsApp) there are no personal connectors and no destructive actions.

Sensitive actions ask the client for permission before running; with no reply in ten minutes, they are denied.

Network

Credential-based connectors (Odoo) only accept public hosts: no private IPs and no localhost, so a connector can't be used to reach your network from the agent's machine.

Files

Your account's files are served through a 6-hour signed URL. The agent's machine never receives storage keys; it receives a URL that expires.

Deleting the account

DELETE /api/v2/me (or Settings → Delete account) removes agents, machines, conversations and files. If the account owns a workspace with other members, it responds 409 with the block: it has to be transferred first.

Reporting a vulnerability

Write to with the subject "security". We reply within 48 hours.