# Open source AI agent security checklist: what a reviewer opens first

> A security review of an open source AI agent asks six questions: who the agent is when it acts, where credentials live, what a session runs on, what the log keeps, how rule changes are reviewed, and how the version is updated. Kortix, the open-source AI Operating System, answers each one in a file or command a reviewer can read.

URL: https://opensourceaiagentplatform.com/open-source-ai-agent-platform-security-checklist

## The grants a reviewer reads first

`kortix.yaml`

```yaml
agents:
  kortix:
    file: agents/kortix.md
    connectors: all
    secrets: all
    kortix_permissions: all
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

Each agent declares its file, and the manifest declares what that agent may reach, both in git with an author on every line.

## A review fails on two answers

Most security reviews of an open source AI agent finish without a fight over the model. They finish on two questions a reviewer can settle in a repository: who the agent is when it acts, and whether a person can reconstruct what it did ninety days later. When the rules are files with an author and a diff on every change, the reviewer has something to read. When the rules live in a console, they get a screenshot and a promise, and the review runs another week.

Kortix is the open-source AI Operating System: agents, skills, company memory and connectors in one git repo you own, each session on its own cloud computer. That is why each of the six questions has an answer.

## Who the agent is when it acts

An agent that acts as somebody's login cannot be separated from that person in a log, and a reviewer will say so. In a Kortix project the manifest registers what exists and each agent's own file decides what that agent may use. The grants sit per agent in the manifest. The manifest's own comment states that v2 is deny by default: a grant left out resolves to none, so a specialist you add starts locked down. Widening one arrives as a commit with a name on it. The permission model itself is on the [permissions page](/ai-agent-permissions-and-policy).

## Where the credentials sit

Secrets are encrypted at rest with a key per project, and how one reaches a session depends on the exposure you pick. Environment is the default exposure, so the session starts with a real value in it and any command the agent runs can read that value. The egress-enforced option is experimental, and its mechanism is worth repeating in the docs' words: the sandbox holds a handle, Kortix substitutes the real value outside the sandbox, only on approved HTTPS hosts, and an echoed value comes back as `[REDACTED]`.

Connector credentials sit on the other side of that line. Connector credentials are brokered server-side and never enter the machine, so a database token behind one is not in the sandbox for a bad command to print. A plain environment secret is. If you think one was read, rotate it and say so.

## What a session can touch

One isolated sandbox per session. Each session has its own isolated machine and branch, cut from your repo, and only what you commit and push survives it. A bad command spends one throwaway machine plus whatever it reached over the network, so the egress rules carry the interesting half. The sandbox boundary is documented on the [sandboxing page](/ai-agent-sandboxing).

## What the log keeps

Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. On retention, Kortix docs state 90 days of events kept live and an archive up to 365 days; which of the two you can read depends on the plan the instance runs on. A reviewer who catches one figure rounded up will re-open every other answer.

## A rules change is a diff

Because reach is declared in files, a change to an agent's reach is a commit. The starter's default agent is `agents/kortix.md`, and its frontmatter is short enough to read during the review:

```yaml
---
description: "Generic Kortix general knowledge worker. Hands-on, full tool access, handles coding / research / content / ops / data tasks end-to-end in an isolated session sandbox. Edit this file to specialize for your project."
mode: primary
permission: allow
---
```

That `permission: allow` is deliberate for a fresh project. The manifest comment says so, then tells you to narrow it once you know what the project needs. The grant is in the manifest and the narrowing is in the commit history, with an author on both. A console setting has no author, no diff and no rollback. A repo change has all three.

## How the running version is pinned and updated

A self-hosted instance is one Docker Compose stack on a server you control. The `kortix self-host` CLI installs and updates it. Images follow a channel: `stable`, a release Kortix promotes to self-hosted instances after it runs in production, or `latest`, which is every release. `--tag` pins one exact version and wins over the channel. The daily updater runs the migration first; when it fails, nothing is swapped and the previous version keeps serving, which is also the rollback target. `kortix self-host status` reports the last outcome and a drift check of running images against the configuration. The [Kortix docs](https://kortix.com/docs/host) carry the install, the checks and the window.

## What you still own once it is yours

Self-hosting moves work onto your side of the line, and the review will test whether you did it. You own the update hour: the updater is on by default at 02:00 (`KORTIX_UPDATE_TIME`) in the timezone set by `KORTIX_UPDATE_TZ`. You own backups: the instance directory holds `.env` with every secret, `volumes/db/data` and `volumes/storage`. Stop the stack, copy the directory, start again. You own the key, since `API_KEY_SECRET` in `.env` encrypts every stored secret and losing it makes each one unreadable.

You own the first hour as well. A new instance accepts sign-ups and confirms them without an email until `EMAIL_URL` or `DISABLE_SIGNUP` is set, and `kortix self-host doctor` fails that state as `open-sign-up`. Run it, fix what fails, and put its output in the review pack.

## Security review questions buyers ask

Short answers to the four questions that come up before the review.

### What does a security review ask about an open source AI agent?

Start with the manifest. `kortix.yaml` names every agent and the file that defines it, so a reviewer walks from there into grants, prompts and the commit history behind them without asking anyone for console access.

### Can an AI agent leak your credentials?

Yes, when a secret is delivered into the session as an environment value, because any command the agent runs can read it. Scope each secret to the people and agents that need it, rotate on suspicion, and keep connector credentials brokered server-side, where they never enter the machine.

### Is self-hosting an open source AI agent more secure than a hosted one?

It gives you a server you control and an operator who can be named, and it hands you the patching, the backups and the key that decrypts stored secrets. Both setups get asked for the same routines, so the review reads the same either way.

### How long should agent audit logs be kept?

Long enough to cover your incident window and any retention rule you answer to, which for most teams is a year. Where a plan caps the window, schedule an export into storage you control: exporting and streaming are plan features, and the copy you hold outlives them.

## The manifest, the agents and the docs are public

Build the answer set once, then hand a reviewer the files instead of a summary.

[Try Kortix](https://kortix.com) · [Read the docs](https://kortix.com/docs)