OpenScience is an AI agent that runs locally on your machine. The agent can run shell commands, read and write files, and access the web.
The permission system decides whether the agent may take an action. A permission prompt is not an isolation boundary by itself. New local installs default to Full access: the project is trusted and the execution sandbox is off. This prioritizes an immediately working research environment and means agent-run commands have your user account's filesystem and network authority.
Use Research tools → Action approval beneath the composer to switch to Approve for me (trust the current project while enabling native containment) or Ask for approval (enable containment and revoke project trust). OpenScience then wraps terminal and shell commands, Python/R kernels, and local compute jobs in macOS Seatbelt or Linux bubblewrap, confines reads and writes to the session workspace and explicitly granted paths, and denies network egress. Run openscience sandbox test; if it does not report Containment verified, do not rely on that backend. Windows has no sandbox backend, and the boundary is not a full VM. Use a container or VM for hostile code.
Server mode is opt-in. The server binds to localhost (127.0.0.1) only and enforces a Host and Origin allowlist to block DNS-rebinding and cross-origin requests. It is not built for remote exposure. If you tunnel or reverse-proxy it yourself, securing that exposure is your responsibility, and anything the server provides in that setup is not a vulnerability.
Self-hosted operators can set OPENSCIENCE_AUTH_TOKEN to require Authorization: Bearer <token> on network requests as an additional deployment boundary. The health endpoint and browser CORS preflights remain open, and trusted in-process calls are unaffected. A reverse proxy must inject or forward the header on ordinary HTTP, streaming, and WebSocket requests. Leaving the variable unset preserves the local default.
| Category | Why |
|---|---|
| Server access when opted in | If you enable server mode, API access is expected behavior. |
| Granted-root contents | A command may read files inside roots explicitly granted to it. |
| Windows sandboxing | Windows has no execution-sandbox backend yet. |
| LLM provider data handling | Data you send to a provider is governed by that provider's policies. |
| MCP server behavior | External MCP servers you configure are outside the trust boundary. |
| Malicious config files | You control your own config; editing it is not an attack. |
Security fixes ship in the latest release on npm (@synsci/openscience). Please
upgrade to the newest version before reporting — earlier versions are not patched.
| Version | Supported |
|---|---|
| latest npm release | ✅ |
| older releases | ❌ |
Please report security issues through the GitHub Security Advisory "Report a Vulnerability" form.
You will get a response with the next steps. The team will keep you updated on progress toward a fix and may ask for more detail. If you do not hear back within six business days, email security@syntheticsciences.ai.