Threat model
The public beta assumes the local operator and explicitly assigned local roots are trusted. It treats models, imported contracts and policies, extension metadata, capsule contents, web pages, external services, browser sessions, and tool output as untrusted.
Assets
Section titled “Assets”High-value assets include provider credentials, OAuth tokens, browser sessions, memory, private prompts, local files, gateway tokens, audit signing keys, and authority to mutate external accounts.
Important attack paths
Section titled “Important attack paths”- prompt injection in model or web content;
- server-side request forgery toward private networks;
- path traversal or symlink escape;
- replay of an approval or idempotency key;
- package or manifest substitution;
- archive traversal;
- unsafe retry after an unknown external outcome;
- credential leakage through logs or evidence;
- public exposure of the local control plane;
- tenant crossover in remote hosting.
Controls
Section titled “Controls”Ódinn uses loopback defaults, exact-origin mutation checks, bearer authentication, DNS-pinned public fetches, browser egress policy, path canonicalization, bounded inputs and outputs, durable recovery journals, signed audit records, exact command allowlists for Proof, short-lived capability tokens, archive validation, and explicit extension integrity and execution modes.
Unknown tools fail toward the restrictive side. Unsafe interrupted work requires review rather than automatic replay.
Residual risk
Section titled “Residual risk”No local agent runtime can reverse a sent email, purchase, deletion, or arbitrary remote mutation. Browser profiles and imported credentials remain valuable secrets. Unconfined extensions execute as the Ódinn operating-system user.
The TLS multi-user host enforces application-level separation and quotas, but mutually hostile users require separate operating-system users, containers, or machines.
The full source threat model is maintained in the repository: Experimental Runtime Threat Model.