Generated agents run inside Claude Code, Codex, or GitHub Copilot, plus a small local Python kernel for tests. The kernel does not call the network unless a host-provided tool adapter does.

• Tools are explicit grants. Ungranted tool names fail the run.
• hard_limits.tool_allowlist further restricts tools when set.
• Human gates cannot be skipped by the kernel.
• Loops and critic retries are bounded.
• Specs should not contain secrets. Use host secret stores if a generated agent must call an authenticated API.

Report vulnerabilities privately via GitHub Security Advisories on rmkr-dev/agent-builder. Do not open a public issue for an exploitable bug until it is fixed.