**Yes. At commit `7a06b657`, I found a significant unsafe default: Orca launches supported agents with permission bypass enabled unless you configure otherwise.** I would change that before using it on a machine with valuable code or credentials.

The main findings:

- **High risk — agent safeguards bypassed by default.** Default arguments include Claude’s `--dangerously-skip-permissions` and Codex’s `--dangerously-bypass-approvals-and-sandbox`. The launch resolver explicitly falls back to these when settings are untouched. A malicious instruction in repository content, or an agent mistake, could therefore lead to commands running without the usual approval or sandbox protections. [Launch defaults](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/shared/tui-agent-launch-defaults.ts#L104-L150), [bypass flags](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/shared/tui-agent-permissions.ts#L10-L46).
- **Sensitive local integration.** Startup initializes account/auth services, schedules eligible Codex session migration, and reconciles managed agent hooks. This makes Orca part of your credential and agent-configuration trust boundary. These are intended features, but increase the impact of a compromise. [Account initialization](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/main/startup/main-process-account-services.ts), [hook initialization](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/main/startup/main-process-ready-runtime.ts#L104-L122).
- **Some useful defenses exist.** Browser guests have Node integration disabled, context isolation enabled, sandboxing enabled, and partition checks. The telemetry consent resolver supports opt-out and `ORCA_TELEMETRY_DISABLED=1`. Those controls do not mitigate agents running with bypass flags. [Browser controls](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/main/window/main-window-webview-security.ts#L62-L103), [telemetry controls](https://github.com/stablyai/orca/blob/7a06b6579bbd106b0cb9bb53978f2cacc7326b9f/src/main/telemetry/consent.ts#L68-L100).

**My recommendation:** test it under a separate OS account or VM without production secrets. Set Agent Permissions to **Manual**, inspect custom launch arguments, and verify new sessions no longer include bypass flags. A Git worktree alone does not isolate an agent from your machine.

This was a targeted source review, not a complete audit. I did not install or execute Orca, audit every dependency, or verify that downloadable binaries match this commit. I found an unsafe runtime default; I have not established that the installer is malicious.

Fixed but not yet released (awaiting review): Nothing.