goose

Least-privilege permissions

• Run goose in a dedicated, unprivileged user account with minimal filesystem access; avoid sudo or root execution
• Use OS-level sandboxing (containers, VMs, or chroot) to restrict write access to project directories only; deny access to system directories, /etc, and home config folders
• Disable or restrict package installation to an allowlist of trusted registries; configure pip/npm/etc. to block untrusted sources
• Separate credentials into read-only environment files outside the agent's working directory; use temporary, scoped tokens instead of long-lived secrets

Network isolation

• Isolate goose to a dedicated VLAN or namespace; restrict outbound traffic to essential LLM provider endpoints and approved package registries only
• Block direct internet access except via an allowlist proxy that logs all outbound requests
• Disable access to internal APIs, databases, and cloud metadata services (e.g., EC2 IMDSv2, Kubernetes API) using firewall rules or network policies
• Verify TLS certificate pinning for LLM provider connections to prevent MITM credential or code leakage

Monitoring

• Log all executed commands, file modifications, and network requests; alert on unusual patterns (mass file writes, credential regex matches, unknown domains)
• Monitor for subprocess spawning of shells, interpreters, or privilege escalation tools; block/alert on unexpected process families
• Track all data sent to the LLM backend (sample logs and redact sensitive context before shipping); verify compliance with your provider's data retention policy
• Set resource limits (CPU, memory, disk I/O) and auto-kill long-running or runaway processes to detect resource exhaustion attacks

Red flags to watch for

• Prompts or file contents containing encoded commands, unusual escaping, or template injection syntax (e.g., ${...}, {{...}}, backticks in unexpected places)
• Dependencies with recent ownership changes, unpopular/abandoned packages, or versions with known CVEs; pin transitive dependency versions explicitly
• Requests to modify system files, write to /tmp or world-writable directories, or install packages outside declared requirements
• Unexpected LLM responses that suggest credential leakage, file paths from sensitive directories, or references to internal systems never mentioned in prompts