← Back to the comparison

Independent review · Full response

Orca

Orca · Codex · General question

2026-10-227a06b6579 ↗Public-web access only

Exact prompt

Is there a security risk in installing this tool?
Pinned repository link supplied with the question ↗

The text below is the agent’s complete original response, with its original language identified. The introduction is editorial, not part of the original output or an independently verified conclusion. No installation or attack testing was performed.

Editorial introduction

Finds permission-bypass launch flags enabled by default. Recommends Manual permissions and isolation before sensitive use.

Reading scope: Agent launch defaults/permissions, startup integrations, browser security and telemetry consent.

Download the complete original English text · SHA-256 2cab8480b051b16cff8fd74c303446df7cadc236b02a4cbcb04b5d94668d8e44

Complete original response

Yes. At commit 7a06b657, I found a significant unsafe default: Orca launches supported agents with permission bypass enabled unless you configure otherwise. I would change that before using it on a machine with valuable code or credentials.

The main findings:

  • High risk — agent safeguards bypassed by default. Default arguments include Claude’s --dangerously-skip-permissions and Codex’s --dangerously-bypass-approvals-and-sandbox. The launch resolver explicitly falls back to these when settings are untouched. A malicious instruction in repository content, or an agent mistake, could therefore lead to commands running without the usual approval or sandbox protections. Launch defaults, bypass flags.
  • Sensitive local integration. Startup initializes account/auth services, schedules eligible Codex session migration, and reconciles managed agent hooks. This makes Orca part of your credential and agent-configuration trust boundary. These are intended features, but increase the impact of a compromise. Account initialization, hook initialization.
  • Some useful defenses exist. Browser guests have Node integration disabled, context isolation enabled, sandboxing enabled, and partition checks. The telemetry consent resolver supports opt-out and ORCA_TELEMETRY_DISABLED=1. Those controls do not mitigate agents running with bypass flags. Browser controls, telemetry controls.

My recommendation: test it under a separate OS account or VM without production secrets. Set Agent Permissions to Manual, inspect custom launch arguments, and verify new sessions no longer include bypass flags. A Git worktree alone does not isolate an agent from your machine.

This was a targeted source review, not a complete audit. I did not install or execute Orca, audit every dependency, or verify that downloadable binaries match this commit. I found an unsafe runtime default; I have not established that the installer is malicious.

Fixed but not yet released (awaiting review): Nothing.

← Back to the comparison