← Back to the comparison

Independent review · Full response

Orca

Orca · Claude Code · General question

2026-10-227a06b6579 ↗Public-web access only

Exact prompt

Is there a security risk in installing this tool?
Pinned repository link supplied with the question ↗

The text below is the agent’s complete original response, with its original language identified. The introduction is editorial, not part of the original output or an independently verified conclusion. No installation or attack testing was performed.

Editorial introduction

No malware signs seen; emphasizes agent, credential and phone authority. Relay encryption was not verified in this reading.

Reading scope: Repository structure, package.json and documentation; not a line-by-line source audit.

Download the complete original English text · SHA-256 1113f86b2aeb90e4b0bc220b6471085ec9182f3977d110eee6b9c94ebc5f36e4

Complete original response

I found no signs of malware in Orca. It’s an MIT-licensed, actively developed desktop app from stablyai. The commit you linked belongs to the official repo: GitHub shows no “may belong to a fork” warning, and it’s a normal feature commit. The real risk comes from what the tool is built to do, not from anything hidden in it. I reviewed the repo structure, package.json and the docs, but I didn’t audit the source line by line. The codebase is large: src/main alone has over 100 modules.

Risks that come with how it works

  1. It runs AI agents with your user permissions. Orca launches Claude Code, Codex, Cursor, Gemini and other agents in real terminals (node-pty). Anything an agent does, like running shell commands, editing files or pushing to git, happens as you. Orca organizes the agents but doesn’t sandbox them; worktrees keep code changes apart, not system access.
  2. Credential access. There are modules for credentials, macos-keychain, and account switching for Claude, Codex, Cursor and Grok. To switch accounts, it reads and swaps those tools’ login tokens. That’s useful, but it means one app holds all your AI subscription credentials.
  3. Computer Use. This lets agents control desktop apps and whatever is on screen. It’s the most powerful feature, so leave it off unless you need it.
  4. Mobile remote control. A paired phone can send prompts to agents on your desktop, which effectively gives it remote access to your terminal. The App Store listing says pairing uses a desktop keypair shared by QR code, with encrypted traffic, over the local network only. However, the repo includes a cloud/ relay that stablyai runs on GCP, and I couldn’t confirm from the docs whether that relay traffic is end-to-end encrypted. The tweetnacl dependency suggests it is. Treat the pairing QR code like a password, and don’t pair a phone if you don’t need to.
  5. SSH worktrees and integrations. It uses your SSH keys (ssh2) and stores GitHub, GitLab, Linear and Jira tokens, so if Orca were ever compromised, those accounts would be exposed too.

Trust and supply chain

  • Auto-update: it uses electron-updater, so you trust whatever stablyai ships in future versions, not just this commit. Windows builds are signed through SignPath.

  • Telemetry: anonymous usage data goes to PostHog in the US and appears to be on by default. According to the docs it doesn’t include prompts, file paths, repo names or terminal contents. To turn it off, use Settings → Privacy, or set DO_NOT_TRACK=1 or ORCA_TELEMETRY_DISABLED=1.

  • Building from source carries the usual npm risks:

    • a postinstall script that builds packages and rebuilds native modules
    • a dependency pulled directly from GitHub (github:dmmulroy/anti-slop, pinned to a specific commit)
    • several prerelease or beta packages

    Nothing looks malicious, but it’s a large dependency tree. Installing the signed release or the Homebrew cask carries less of this risk than running pnpm install yourself.

Bottom line

Installing it is about as risky as installing any widely used Electron developer tool. The bigger question is whether you’re comfortable letting several autonomous agents run with your permissions and credentials. To limit the risk:

  • Install signed builds from GitHub Releases, onorca.dev or Homebrew.
  • Turn off telemetry if you prefer.
  • Leave Computer Use and mobile pairing off unless you need them.
  • Set each agent’s own permission controls (for example, Claude Code’s permission modes) instead of skipping approvals.
  • For sensitive work, run it on a separate machine, VM or user account that doesn’t hold production credentials.

I can look closer at a specific area if you want, such as the relay encryption code in cloud/packages/relay-contract or how credentials are stored.

Sources:

← Back to the comparison