Security Overview
How Sophon keeps agents, credentials, and code execution safe.
Sophon gives an autonomous agent real power: tokens for dozens of services, the ability to run untrusted code, and (via Sophon Node) the ability to click buttons on a user's machine. The security model exists to make that power safe by default. It boils down to four risks: credentials that must stay out of the model's prompt, irreversible actions that need a human in the loop, untrusted code from the marketplace or self-authored skills, and untrusted text that tries to hijack the agent.
This section is the hub for how each of those is hardened.
The model at a glance
| Risk | Control | Where it lives |
|---|---|---|
| Raw secrets reaching the LLM | Encrypted vault; the runtime, not the model, resolves the token | Credential vault + tool executor — Credential Vault |
| Sending email, money, deletes | Human approval gates | Approval gate + risk classification — Approval Gates |
| Marketplace / custom skill code | Docker + gVisor sandbox | Sandbox policy presets — Sandbox |
| Injected instructions in messages, tool output, webhooks | External-content wrapping + tiered detection (Off / Warn / Block) | External-content wrapper — Prompt Injection Defense |
| Request floods | Per-user / per-IP rate limiting | Gateway rate limiter |
| Accountability | Audit logging | Audit trail across every control |
| Adversarial-AI attack surface | MITRE ATLAS technique mapping + residual-risk roadmap | Threat Model |
Credential handling
The token never enters the prompt. When the LLM calls a built-in tool, the runtime — not the model — resolves the call, fetches the token from the vault, makes the API call outside the model context, and returns only the sanitized result. Tokens are encrypted at rest (AES-256-CBC, bound to your Windows account via DPAPI where available), OAuth 2.1 + PKCE is preferred over static keys, and every access is logged.
A sandboxed skill is different: when its manifest declares a credential, the stored credential is delivered into that skill's container for the duration of one execution. It is out of the model's context, but the skill code itself holds it — so install skills you trust, and see Sandbox for what else the container can and cannot do. A brokered proxy that would make the call on the skill's behalf is on the roadmap, not shipped.
See Credential Vault.
Sandboxed code execution
All user-authored, self-authored, and marketplace skill code runs in Docker containers under the gVisor runtime, with CPU/memory/disk/time limits, an ephemeral workspace, and no outbound network unless the skill's manifest declares an explicit allowlist. Built-in policy presets range from minimal isolation to locked-down (no network, read-only filesystem, no process spawn), and Linux deployments add a Landlock LSM layer. Marketplace skills pass automated static analysis and a mandatory human review before publication, and every install is verified against a SHA-256 checksum (fail-closed).
See Sandbox and Code Execution.
Human approval gates
Before any sensitive or irreversible action, Sophon pauses and asks. Every tool call is risk-classified (None through Critical) and compared against your threshold, which defaults to Medium; a per-tool override can raise or lower a specific tool, and Critical always prompts whatever the threshold says. The prompt is raised once, before the tool runs, and reaches the surface the conversation came from — including the messaging channel. The user sees exactly what will happen, can edit drafts before approving, and timeout equals reject — nothing is ever auto-approved by inaction. Destructive actions are default-deny.
There is no bulk-operation threshold today: many individually low-risk actions are not aggregated or gated as a batch. That is tracked as R-12 in the threat model roadmap.
See Approval Gates.
Prompt-injection defense
Untrusted text — inbound channel messages, tool results, webhook payloads and the memory snapshot — is wrapped in external_content boundary markers before it reaches the model. Each block carries a per-block id the content cannot predict, so it cannot forge a closing marker to "break out," and any literal closing marker inside the content is de-fanged. On top of that, a tiered pattern list decides what happens on a match, under a host-wide mode set at Settings → Security → Prompt injection (Sophon:PromptInjection:Mode, admin-only, no restart): Off, Warn (the default — annotate, notify, record, continue), or Block. Block stops a turn only when third-party content — a tool result, a webhook payload, or a channel message from a group or a non-owner — matches a High-severity pattern; your own messages and the memory snapshot are never blocked. What a paired node reports about your desktop arrives as a tool result, so it is treated as third-party content like any other.
It remains a literal-phrase filter, not a boundary: obfuscated, split, or image-embedded instructions get through, and tools called through the embedded MCP server are not scanned.
Rate limiting
The Gateway applies global HTTP rate limiting: per-user when authenticated, per-IP otherwise, returning 429 with a Retry-After header. Limits are generous flat defaults, fully config-tunable, and health, metrics, and hub endpoints are exempt. Cron jobs can opt into random schedule jitter to avoid thundering-herd firing.
See Rate Limiting.
Audit logging
Every tool call, approval decision, credential access, and admin action is recorded with a timestamp, user and tenant ID, redacted parameters, outcome, and a correlation ID for tracing. On Enterprise this is browsable and queryable for compliance review.
See Audit Logging.
In this section
- Credential Vault — encrypted storage and how tools reach a token
- Sandbox and Code Execution — Docker + gVisor isolation and policy presets
- Prompt Injection Defense — wrapping, detection modes, and the limits
- Rate Limiting — per-user and per-IP request budgets
- MITRE ATLAS Threat Model — trust boundaries, ATLAS technique coverage, and the hardening roadmap
Related: Approval Gates, Audit Logging, Architecture Overview, Sophon Node.