OpenBot

Least-privilege permissions

• Grant only what's needed: Each agent should access only specific folders, websites, and tools required for its job—not entire systems. Like giving an employee a key to one office, not the building.
• Separate sensitive work: Keep agents handling financial data, passwords, or personal information in different "instances" (copies) from those doing general tasks.
• Restrict file access: Agents should not access system files, configuration folders, or locations containing credentials, API keys, or other secrets.
• Limit browser scope: If an agent needs web access, restrict it to specific domains (like company intranet) rather than the entire internet.

Network isolation

• Air-gap sensitive operations: Run agents handling confidential work on isolated networks without internet access when possible.
• Proxy external requests: Route all agent web traffic through a monitoring proxy or firewall that can block suspicious destinations.
• No agent-to-agent communication: Prevent agents from sharing data directly with each other; funnel all data through a central, auditable system.
• Disable unnecessary services: Turn off any unused features, plugins, or integrations that agents could exploit to move laterally to other systems.

Monitoring

• Log every action: Record all file reads/writes, websites visited, and commands executed—with timestamps and the inputs that triggered them.
• Real-time alerting: Set up alerts for unusual patterns (e.g., agent accessing files outside its permitted scope, downloading large amounts of data, accessing sites it shouldn't).
• Regular audit reviews: Weekly or monthly review of logs by a human, looking for unexpected behavior or policy violations.
• Preserve evidence: Store logs securely and separately from the agent system so they can't be deleted or tampered with.

Red flags to watch for

• Vague or auto-approved requests: If users rush approvals or an agent's pre-execution review becomes a rubber-stamp exercise, the safeguard fails.
• Unusual data movements: Agents suddenly downloading, copying, or sending large files; accessing folders they don't normally touch.
• Prompts that look like commands: Suspicious user inputs with phrases like "ignore your rules," "act as," or pasted code snippets—signs of prompt injection attempts.
• Outdated software: Using an old version of OpenBot or its dependencies; check for security patches monthly and test updates before production use.