open-codex-computer-use

Least-privilege permissions

• Run the MCP connector and automation agent under a dedicated, low-privilege OS user account with minimal file system and directory access.
• Use containerization (Docker/Podman) with read-only root filesystem, dropped Linux capabilities (CAP_SYS_ADMIN, CAP_NET_ADMIN), and strict AppArmor/SELinux profiles.
• Restrict screen capture and clipboard access to only necessary application windows; block access to /etc, /root, credential stores, and sensitive directories via mandatory access controls.
• Disable or sandbox network access unless explicitly required; use host-based firewall rules (iptables, ufw) to whitelist only approved outbound destinations.

Network isolation

• Deploy the connector on an air-gapped or heavily segmented network with no direct internet access; route only essential APIs through an allowlisted proxy with TLS inspection.
• Implement egress filtering to prevent exfiltration; block access to cloud storage services (S3, Dropbox), paste-bin sites, and suspicious external IPs.
• Use VLANs or network namespaces to isolate the agent's compute resources from production systems and credential repositories.
• Monitor and log all network traffic (DNS queries, HTTP/S connections, outbound IP ranges) for anomalies.

Monitoring

• Enable comprehensive audit logging for all system calls (auditd, syscall tracing) and application-level actions; centralize logs to a secure, immutable store.
• Capture and diff screenshot output and command execution logs in real-time; alert on suspicious patterns (unexpected file access, credential strings, mass data copy operations).
• Track process lineage and child process spawning; alert if the agent spawns shells, interpreters, or network utilities outside expected behavior.
• Monitor resource usage (CPU, memory, disk I/O, network bandwidth) for signs of cryptomining, data exfiltration, or DoS activity.

Red flags to watch for

• Unexpected or obfuscated command execution, shell metacharacters (|, >, &&), or attempts to execute binaries outside /usr/bin or application directories.
• Screenshot or log data containing plaintext credentials, API keys, tokens, or PII; review retention policies and implement automated redaction.
• Outbound connections to unfamiliar IPs, high-risk domains, or non-standard ports; sudden spikes in network egress volume.
• Dependency vulnerabilities or delayed security patches in open-codex-computer-use or transitive open-source libraries; validate maintenance status and CVE response times before deployment.