Security, in plain words

The Mission page explains our safety philosophy. This page is the practical version: the specific risks of running AI agents, what Cronus does about each one, and what it honestly cannot do for you.

The risks that actually matter

When people worry about AI, they picture wrong answers. The riskier failures are quieter: context leaking somewhere it should not, an agent doing something real that you did not intend, a credential ending up inside a prompt, or an imported ability doing more than it advertised. Cronus's protections map to those four.

Context leaks

• Rooms by default. Each agent's conversation is isolated. What you tell one is not ambient background for another.
• Visible handoffs only. Context moves between agents through Orchestra, where you see exactly what moves before it does. There is no invisible shared pool.
• Local by architecture. The dashboard serves only your machine. There is no Cronus cloud holding a copy of your conversations to breach.

Unintended actions

• One agent per job, named. Cronus routes each request to exactly one agent and tells you which. No silent fan-out.
• Clarify over guess. An ambiguous request triggers a question, not a best guess executed at machine speed.
• Raw output, always. Agent windows stream the real work. A failure looks like a failure, never a dressed-up success.
• Approvals on risky actions. Agents that act on the real world (like OpenClaw) support explicit approval gates, so capability never has to mean autonomy.

Credentials

• An encrypted vault, write-only by design. Keys you save are encrypted on disk, and once saved, the value is never displayed again - not in the UI, not in logs, not in prompts.
• Keys are not context. The vault exists precisely so that secrets never ride along inside a model conversation.

Imported abilities

• Skills are readable files. Before you let an agent use an ability, you can open it and read what it does. No black boxes.
• Community skills carry provenance. Skills from the public market ship with documentation of what they do and where they came from, and are scanned before publishing.

Where to run it

Cronus drives agents that can run commands and touch files. That is the whole point - and it is why, during alpha, we ask you to treat it like a power tool and run it somewhere you can afford to experiment:

• Best: a spare computer with nothing precious on it, or one that is fully backed up. An old laptop is perfect.
• Also great: a virtual machine on the computer you have - VirtualBox (free, Windows/Linux) or UTM (free, Mac). Take a snapshot after installing and you can reset the whole machine any time.
• For 24/7: a small cloud server. Oracle Cloud's free tier is genuinely free forever (though grabbing a free server can take a few tries); Hetzner is the best cheap paid option at around $7 a month. This route needs some comfort with Linux - email us for a walkthrough.
• Never on a computer your employer owns. Their IT department is not part of this alpha.

How the app itself is built

Beyond how you use it, the software has its own defenses, and we audit them. The most recent full audit of the codebase was July 21, 2026. In plain words:

• Local only. The backend listens on your own machine (127.0.0.1) and nowhere else. There is no Cronus cloud, no account, and no telemetry: we cannot see your data because it never reaches us.
• Websites cannot reach it. A malicious page you visit cannot send commands to your Cronus: requests are checked for where they came from, and anything cross-origin is rejected.
• Keys are encrypted at rest. The credential vault encrypts every secret on disk, never shows a saved value again, and never puts one into an AI prompt.
• Escalations need explicit consent. Loosening an agent's permissions requires a deliberate confirmation. Nothing switches itself to a more powerful mode.
• Updates are your call. The app checks for updates only when you click the button, and installing one is always a choice you make.

What Cronus cannot protect you from

Honesty is the policy, so here is the other column:

• A compromised computer. Cronus lives on your machine; if the machine itself is compromised, so is everything on it. Keep your OS updated and your disk encrypted.
• What you send to a provider. Route a message to a cloud model and that provider receives it, under their terms. Local models exist exactly for the content you never want to leave home.
• Access you hand over. If you give an agent your email and approve its sends, it can send email. The approval gates only help if you read them before clicking yes.
• A skill you approved without reading. We make abilities inspectable; we cannot make you inspect them.
• Alpha software reality. Cronus is young. We fix issues fast and never hide them, but "battle-tested" is earned over years, and we will not claim it early.