Skip to main content
Fleet Prime Agent runs on your machine, with your permissions, and executes model-generated Python and shell. Read this before pointing it at anything sensitive.

​
Trust model

  • The agent executes model-generated Python (ipython) and shell (bash) commands with your user permissions.
  • IPython kernels and worker processes improve isolation but are not a security sandbox. See SECURITY.md in the repo.
  • The web server binds to 127.0.0.1 and has no multi-user auth. Do not expose it beyond localhost without your own auth layer.

​
Credential storage

Credentials resolve, in order:
  1. Runtime overrides (setRuntimeApiKey, populated by --api-key). In-memory only.
  2. Environment variables (packages/ai/src/env-api-keys.ts), unless --no-env is set.
  3. ~/.prime/agent/auth.json (mode 0600), through FileAuthStorageBackend.
  4. OAuth flows (packages/ai/src/providers/oauth/) for providers that support them.
packages/ai no longer persists OAuth credentials itself; callers do (usually via auth.json). Long-running sessions refresh OAuth tokens dynamically via getApiKey so mid-run expiry doesn’t break the run.

​
Environment forwarding

DAEMON_CLIENT_ENV_KEYS in packages/coding-agent/src/modes/daemon/daemon-protocol.ts limits which env vars a client can forward to the daemon. Everything else stays on the client.

​
Optional OS sandbox

packages/coding-agent/examples/extensions/sandbox/index.ts adds an OS-level sandbox powered by @anthropic-ai/sandbox-runtime. It’s disabled by default. Enable it when running the agent against untrusted content or in shared environments.
Last modified on August 17, 2026