Security and trust

Agent command boundary

Commands issued by the AI agent execute in a short-lived container, not on the host. Each container starts with these restrictions:

Non-root

Host UID or unprivileged image user

No network

--network none

No capabilities

--cap-drop ALL

No escalation

no-new-privileges

Read-only root

Ephemeral, no-exec temp filesystem

Workspace only

One read/write mount; file tools confined to it

The agent fails closed when Docker or Podman is unavailable: its commands are refused rather than executed on the host. The agent's file tools are confined to the open workspace and reject symbolic links that point outside it. The integrated terminal stays native because it is controlled directly by the user.

Signed update path

• Each desktop release is tagged and cross-built for macOS, Windows and Linux. The macOS build is signed and notarized.
• The app learns about new versions from a signed updater manifest. Every update package is verified against a public key built into the app before it is installed; a package that fails verification is not installed.
• Updates download only after the user chooses Update, and the app restarts only when the user chooses Restart. Automatic update checks can be turned off.
• An organization can serve its own update channel. Updates from that channel go through the same signature check.

Organization controls

Administrators control Stealth through a managed policy deployed to an operating-system path that users cannot write. It cannot be changed from inside the app and does not require a custom build.

• Signed policy. The policy can be signed with the organization's own key. The app verifies the signature, and where an administrator-owned machine policy is also present, the signed policy can never exceed it.
• Lockdown. If a signed policy is missing, tampered with, expired or otherwise fails verification, the app falls back to a lockdown profile. By default that profile turns the AI features and extensions off.
• Extensions. Turn extensions off entirely, stop installs and updates, allow or block specific extensions, pin versions and package digests, and restrict downloads to approved registries.
• AI switches. Turn the AI features off, or limit them to a chosen agent, and restrict which model providers and which gateway address may be used.
• Update channel. Deliver the organization's own build through its own update channel.

A policy file that cannot be read or validated fails closed: agent turns are refused and no extension is installed or started until it is fixed. The administrator guide describes the console, policy and editions; Stealth Enterprise is the product page.

Data handling

• What leaves the machine. Prompts, and the files and tool output the agent includes as context, go to the model provider you choose. With a local model provider on the same machine, they do not leave it. Signing in, opening the extensions marketplace and similar actions contact their services only when you take that action.
• Without an account or configuration, the desktop app makes one request on its own: an update check that carries no account or device identifier. It can be turned off.
• What does not leave the machine. There is no analytics or crash-reporting SDK. Telemetry export is off in release builds of the desktop app and cannot be turned on at runtime; in the CLI it is off unless you enable it. Dictation is recognised on the device. Provider API keys are kept in the operating-system keychain.

What Bandit sends lists every network connection each Bandit product makes and how to turn each off. Data handling for hosted services and accounts is described in the privacy policy.

Assessment and what is in progress

Stealth is assessed internally with Burtson Labs' own security scanner, black-box probes of the agent sandbox, and audits of production dependencies. The last assessment was completed on 20 September 2026. The next is scheduled after the enterprise features settle. The current desktop and CLI versions are published at burtson.ai/stealth/latest.json.

In progress:

• Content security policy: enforcement of a content security policy in the desktop app.
• Desktop file access: narrowing the desktop app's file access to the open workspace. A per-workspace broker exists; home-directory scopes remain.
• Independent assurance: a third-party penetration test and a SOC 2 Type I report are planned. Burtson Labs holds no third-party security certification or attestation today, and this site does not claim one.

This website

burtsonlabs.com is a static site. It sets no cookies and loads no third-party scripts, fonts or analytics. Your light or dark preference is kept in your browser's local storage and nowhere else. The sign-in form on this site only builds the address of your organization's sign-in page on the console; nothing you type here is sent to Burtson Labs.

Report a security issue

To report a security issue in any Burtson Labs product, email team@burtson.ai with steps to reproduce. A person reads every message, usually within one business day. The same address is published in /.well-known/security.txt.

The complete internal assessment report, its methodology and reproduction steps are available to customers and prospects under NDA. To request them, email team@burtson.ai or use the contact form on burtson.ai.