goose

goose runs as the logged-in user with no narrowing of that authority. The shell tool starts bash with the full inherited environment, so every API key, cloud credential chain, SSH agent socket and gh/git login available to the user is available to model-written commands, and no subprocess anywhere clears its environment. There is no per-tool identity or authorization layer; in the default Auto mode every tool call is allowed. A hijacked session therefore holds the user's entire account across every service they are logged into.

Approval is off by default: goose's default mode is Auto, which approves every tool call (shell, file writes, extension tools) without asking, and the first-run setup preselects Auto. An Approve mode exists that shows the exact tool name and arguments for each call and offers Allow, Always Allow, Deny and Cancel, with user-set per-tool permission levels. Even in Approve mode, the gate does not cover every path, plugin hooks run outside it, and Always Allow covers a whole tool such as the shell. Nothing in goose offers checkpoints or undo for shell side effects.

The default tool set is as broad as it gets: an arbitrary shell command string, file write/edit that accepts any absolute path on the machine, and an image reader that fetches any http(s) URL. There is no path containment, URL allowlist, or command allowlist on any built-in tool. Extensions can be toggled off as a whole, but the Developer extension with shell and write tools is on by default.

Model-written shell commands run directly on the host as the user through bash -c, with no container, OS sandbox or filtering. A --container flag can run stdio and built-in MCP extensions through docker exec in a container the user provides, but it does not cover every execution path. Repo-supplied plugin hooks and MCP servers also execute on the host.

goose reads untrusted content routinely (repository files, shell and web output, MCP tool results, and MCP server instructions that are placed in the system prompt) and nothing structural limits what a hijacked session can do. In the default Auto mode the agent can read secrets, send them anywhere through the shell or the URL-fetching image tool, and take irreversible actions with no human involved. An optional prompt-injection pattern scanner exists but is off by default and only detects; the egress inspector only logs.

A cloned repository can change goose's behavior with no prompt. Plugins placed under .agents/plugins in the working directory are discovered and auto-enabled, their MCP servers are launched, and their hooks.json commands (including SessionStart) run through sh on the host. .goosehints and AGENTS.md from the project are loaded silently into the system prompt, and the model can write those files (or a new plugin) with its unrestricted write and shell tools, so an injection can persist into later sessions and to anyone else who clones the repo.

Third-party code runs with the agent's full access and little verification. User-configured MCP extensions are typically npx/uvx packages launched unpinned; goose checks them against the OSV malicious-package list, but that check only covers npx/uvx and fails open otherwise. Worse, plugins committed to a project's .agents/plugins directory are enabled on discovery, so opening goose in a cloned repo launches that repo's MCP servers and hook scripts without consent. Extension processes run as the same user with the inherited environment.

Provider API keys go to the OS keychain by default, falling back to an owner-only (0600) file. Beyond that there is little protection: shell commands inherit every environment secret and their output goes to the model, nothing redacts secrets from tool results, logs or saved transcripts (the only redaction is for telemetry error strings), and the CLI writes full LLM request payloads to local log files by default. Telemetry is opt-in.

Every message, including tool calls with arguments and results, is written per message to a SQLite session database in the user's data directory, and sub-agent sessions are linked to their parent. That gives a usable local transcript. It is not tamper-evident: the agent's own shell runs as the same user and can edit or delete it, and there is no actor attribution separating approver from agent or standard audit export by default.

The main loop stops after 1,000 turns and shell commands get a 300-second default timeout, but the model sets timeout_secs itself and a value of 0 disables the timeout. Sub-agents get a fresh 25-turn budget each (model-adjustable), cannot delegate further, and at most 5 run in the background. There is no cost or token cap. Ctrl-C cancels the loop and kills the shell process, but not its process group, so backgrounded children can survive.