The Honest Safety Story
No vague “we take security seriously” hand-waving. Here's exactly what protects you — and what doesn't.
Notarized by Apple
Apple scanned it for malware. Gatekeeper verifies the signature on every single launch.
Hardened Runtime
Code-injection protection is on (Apple requires it for notarization): macOS stops other apps from injecting code into the running app, attaching a debugger to it, or slipping in libraries that aren’t signed by us or Apple.
Developer ID Signed
Tamper-evident and tied to a verified developer identity. If the binary is modified, macOS refuses to run it.
Keychain with a code-signature ACL
API keys live in your macOS Keychain under an access-control list bound to Agent Mac’s code signature — only the genuine, signed binary can read them. Not a config file, not a browser store.
Zero telemetry
No analytics SDK in the binary, no crash reporter phoning home, no usage tracking. The app contacts agentmac.app only for trial and licence checks and a once-a-day update check, plus, only if you use them, a connector request and the hand-off page for signing in to the Slack connector. While it runs it also sends a small connection check, with no key and no message, to the AI provider you picked, to see whether it can be reached. All of it is listed on the Privacy page. Opt-in anonymous diagnostics sharing is built in, but it is switched off and hidden in this release, so nothing is sent. Your conversations stay in local SQLite; your memory stays in markdown on your disk.
No company backend for remote
A paired iPhone talks straight to your Mac: over your Wi-Fi with a pinned TLS certificate once you allow LAN connections, or over your own encrypted Tailscale network. If you turn on Away access, it falls back to your own iCloud account when it can’t reach the Mac directly, sealed end-to-end (HKDF + AES-GCM). There is no company backend in the path.
Not Sandboxed — Here's Why
Same as Terminal, VS Code, and every serious dev tool — sandboxing would block the file access, shell commands, and browser automation that make Agent Mac useful. You control the risk through 4 autonomy levels and on/off switches for most tools.
You Decide How Much It Does Alone
Ask Always
Confirms every action before running. You stay in full control of every read, write, and command.
Smart
The default. Auto-approves safe reads, searches, memory and a short list of read-only shell commands; asks before file changes, deletions, other shell commands and most other actions.
Full Auto
Hands-free within guardrails. Ideal for scheduled tasks that run while you’re away.
YOLO
Unlimited steps, no planning, no routine confirmations, and it can use most tools you switched off (Messages, Mail and computer control stay off until you first turn them on). Messages and emails, card payments, cloud GPU rentals and a few safety checks still ask first, and protected files stay off-limits. Phone runs never use it.
On top of the levels, most of the 32 tools have their own on/off switch, and screen control, Messages and Mail start switched off. (YOLO ignores most switches, but Messages, Mail and screen control stay off until you turn them on.)
What holds at every autonomy level, even YOLO
- Sending through Messages, Mail or Agent Mail asks first whenever you’re there, on the Mac or on your iPhone, and “allow for this session” can’t switch that off. There are two exceptions, and you choose both: a scheduled task you set up, and a Team agent you’ve allowed to send under a no-approval preset (Complete mission or Bypass). The Messages and Mail switches and the agent’s Access tab tell you this.
- Every card payment needs its own approval: Touch ID or your login password on the Mac, Face ID or Touch ID on your iPhone. The amount is checked against the checkout page first, and the AI never sees the card number.
- Renting or terminating a cloud GPU needs your approval of the live price in Agent Mac’s own approval panel, every time. Scheduled and Team runs can’t do it.
- Clicking and typing on your screen, and handing a job to Claude Code, ask every time. A session-wide “allow” doesn’t cover them, and scheduled runs can’t use them. (Just looking at the screen doesn’t ask.)
- Agent Mac’s file tools refuse to read SSH keys, keychains, cloud credentials, browser password and cookie stores, crypto wallets and the card vault. Its shell tool refuses commands that touch keys, keychains, cloud credentials or the vault. The agent can’t write to system folders or install anything that runs at login (launch agents, shell startup files, cron jobs, SSH login keys).
- Since 2.3.2 its file, shell and connector tools also can’t read or change Agent Mac’s database, stored documents, backups or connector list, or edit its skills, memory, hooks or settings behind the app’s back. Since 2.3.3 that includes its diagnostic traces.
- Web pages, connector results, imported chats and files, messages you’ve received, and scans filed in the cabinet all count as outside content. So does anything a sub-agent has read, so it can’t be handed back as if it were trusted. While any of it is in the chat, an action that could change, send or spend something asks first. A scheduled run refuses the action instead.
- A Team agent that has read outside content has to ask before it hands a job to a teammate who can send without asking, or before it saves to its own memory. (An agent on Complete mission is refused instead.)
- A change to more than 10 files or items at once shows a dry run and asks.
- The agent’s delete tool moves files to the Trash. “Revert file” puts back Agent Mac’s own saved copy of a file it edited, shows both paths first, and moves the current version to the Trash.
What doesn't
- “Don’t ask permission” (Settings ▸ Permissions, or saying “stop asking” in a voice chat) also switches off four protections for hands-on runs on your Mac: the outside-content check, the bulk dry run, and the screen-control and Claude Code prompts. Sends, card payments, cloud GPU rentals and the file rules still hold. Runs from your iPhone or on a schedule keep every prompt.
- Claude Code and screen control work outside the file rules. That’s why they always ask.
- The shell checks are best-effort. A shell rm deletes for good, though wiping your home folder, a top-level personal folder or a system folder is refused.
- Outside content is tracked by the tool that fetched it. Web text the agent saved to a file and read back, or downloaded with a shell command, isn’t flagged.
Don't take our word for it — verify it yourself
shasum -a 256 ~/Downloads/AgentMac.dmgspctl -a -vv /Applications/AgentMac.appThis is Apple's own spctltool. If it says “accepted” and “Notarized Developer ID”, the app is legitimate and untampered.
Try it free for 21 days.
Download it, use it properly, then decide. If it earns a place on your Mac it's one payment of £44.99, never a subscription.
Download Free Trial- Free for 21 days
- No account
- No credit card
- Notarized by Apple