What AI agents you can text publish about their own security

Of the 90 agents in this directory, 16 publish a document about their own security. 18 publish somewhere to report a hole. 8 name prompt injection, the attack that is specific to what these products are, on any page a person can read. 3 say they pay for a report. 23 say when the agent stops to ask you first. Every one of these is a count of a published sentence, read on one day across all 90, and recorded on the listing it belongs to with the date.

Every product here reads your messages. 38 say what they are given when you connect an account, which is its own piece. This one is about the rest: what a company chooses to tell you about how it protects what it holds, and how it stops the thing it built from being turned against you.

Five questions, and how many answer each

The questions are the ones a person would ask before handing over an inbox, and each is answered by a page or not.

A security document. 16 of 90 publish one: a page headed security, a trust centre, or a section of the documentation. The fourteenth arrived on 23 September, when Slashy was listed: its page answers in questions, names every subprocessor with a purpose and a country, and is the only one here that names the company carrying its iMessage. Three of them, Lindy, Catch and Ollie, state SOC 2 Type II with an auditor named or a trust centre listing it; Lindy and Ollie add HIPAA-mapped controls and penetration testing. Town publishes a security annex, dated June 2026, as the schedule to its data processing addendum. alfred_, Allora and Flip publish a page of practices: encryption at rest, isolated containers, no password ever seen, read-only bank access. The twelfth and thirteenth arrived on 17 September, both listed that day. Sabi publishes a security page with per-customer isolation enforced by the database, OAuth tokens held by managed-auth platforms rather than in its own store, an approval gate on outbound actions, and SOC 2 described as in preparation. Tab, still a private beta, publishes the most mechanical page in the set: how a password is encrypted and where it is decrypted, how a card is entered through a ten-minute link into a vault that returns only a reference, and a rule that an unconfirmed outcome is never treated as a success. The fifteenth arrived on 29 September with OpenAI's dots: a launch-day write-up describing a sandboxed cloud computer for each dot, kept apart from the systems that enforce its checks, and a credential service that supplies saved passwords without passing them to the model. The sixteenth, listed on 3 October, is Fambot, a family agent whose trust page names every vendor with what it is sent, how long it keeps it and where it is. The other 74 publish nothing beyond the word "encrypt" in a privacy policy, which is a word, not a control.

A route in. 18 publish a security contact: an RFC 9116 security.txt, a disclosure page, or an address. That number was found by a script that refuses a page behind a login, and it is the one count on this page that the site has kept since the day Meta shipped Muse with a threat model and a bounty and none of the criteria here could see either.

Prompt injection, named. 8 products say the words on a page of their own. Instinct's privacy policy warns of "interactions with third parties who may include misleading instructions intended to influence autonomous agents", which is the attack described without the term. Muse's write-up names it and pays for it. Zo's disclosure page welcomes reports of it and says they are not typically eligible for a reward, because of "the inherent nature of LLMs". The sixth, on 17 September, is Sabi, whose security page calls the product "prompt-injection aware" and puts it as knowing "the difference between you and the emails she reads", with the approval gate as the backstop when it does not. The eighth, on 29 September, is OpenAI's dots, whose safety write-up describes instructions hidden in a webpage, email or document that try to redirect the agent, and answers with tool restrictions, checks before actions and monitoring.

OpenClaw's security page says the opposite thing in the same spirit: prompt injection "without a policy, auth, approval, sandbox, or tool-boundary bypass" is not a vulnerability by itself. Vellum's documentation makes the strongest claim of the five: its permission checks run in a separate deterministic process outside the model, so "there's no way to prompt-inject past a permission boundary". Two products that name the attack say it cannot be fully fixed; one says it has been fenced.

A bounty. 3. Muse, up to $300,000 through Meta's programme with up to $130,000 for a prompt injection affecting one user. Zo, a programme with scope and rules of engagement. OpenAI, listed on 29 September with dots, runs a paid programme through Bugcrowd, and nothing on the dots pages says whether dots is in scope. OpenClaw states there is no paid programme, and then publishes what a paid programme usually hides: 1,799 reports filed since January 2026, 722 fixed and published, 39 with a CVE, 14 confirmed critical and all fixed, updated on the day this was read. It is the only ledger of its kind on any listing here and it belongs to the one open-source project in the set.

Asking first. 23 say when the agent stops. Muse: emails and purchases, approved before they happen, and a card naming the hostname and port before a new network protocol is used. Vellum: every tool carries a risk level, and a setting from Strict to Full access decides which ones prompt. Flip: nothing changes an account, contacts a person or moves money without explicit confirmation. alfred_: drafts go out only when approved. Three arrived on 12 September with the answer on their front pages: Airtap, where an action is approved with a tap in the thread and a saved routine then runs without you; Air by WZRD, where publishing and spending wait in the thread and the wallet never moves funds without approval; and Wis.ai, which asks before it ever spends your money. Two more the same weekend: asaply, where every order shows the total and waits for a tap, and Brea, where booking, buying or sending waits for a yes and a kill switch stops the agent. The eighteenth, on 25 September, is Otty, which puts the boundary on its front page: asking to see jobs does not give permission to apply, and you agree in the chat which jobs it may apply for and how many applications to send. The nineteenth, on 29 September, is OpenAI's dots: built-in rules for when to act and when to ask, Custom Rules that allow, require approval for or block an action, and an automatic review of anything that could affect your accounts or share information. The twentieth, read on 3 October, is Rene, whose FAQ says it drafts the next step and asks before anything sensitive is sent or changed. The twenty-first, listed the same day, is Fambot: no email sent without an explicit go-ahead, and no calendar event changed that you did not ask about. The twenty-second, on 11 October, is Coral, where parents decide which purchases need their approval. The twenty-third, read on 22 October, is Boba, which says it books things once you say yes and asks before anything big.

Catch, Lindy and OpenClaw say approvals exist without saying for what. The other 67 say nothing.

Instinct, the product whose defining choice is acting first, answers this row in the opposite direction, and it took a re-read on 23 September to notice. Its terms have no confirmation step in them at all.

What they have instead is the appointment: you appoint the Services as your agent to enter into agreements, commitments or transactions on your behalf, Actions "may not always be reversible", and every consequence is yours, financial, contractual, legal or reputational. That is a published sentence about when the agent stops, and it says never.

What the documents do not say

The most detailed document in the set is Muse's, and the sharpest question anyone has put to it is about the hop it does not cover: whether the model that reads your messages runs inside the isolated machine the document describes, or outside it. The write-up describes the machine, the guard on everything leaving it, and the bounty; it does not say where inference happens.

A user put it this way: an elaborate lock on the bedroom, and the diary mailed out every 300 milliseconds. Meta could answer in a sentence and has not.

The SOC 2 claims are recorded here as the vendors state them. Nothing on this site has seen a report, and a SOC 2 Type II says an auditor checked that the controls a company described were operating; it does not say what the controls were. Lindy and Catch offer the reports on request, which is the normal arrangement and the right one to take up before connecting an inbox.

And the count at the top is a count of what companies choose to publish. A product with no security page may run one of the tighter architectures here and never have written it down; a product with a trust centre may be listing certifications its messaging path does not sit inside. What this page can say is that 74 of 90 give a person nothing to read, and that a person who wants to know is left to ask.

What to watch

The first is whether the count of security documents moves. 16 is a fact about publishing, it costs a page, and the products with the most to lose from a breach are among the ones with nothing published.

The second was whether a sixth product names prompt injection, and one did on 17 September, in a sixth register: aware, with a gate behind it. The next one to say the words will have to pick a register, and the range is the finding.

The third was whether a third product states a paid bounty. One did on 29 September, when OpenAI's dots was listed, though no page says whether dots is in scope. Of the first two, one, in the same breath, says the attack most specific to this category does not usually qualify. A bounty that pays for prompt injection is a company saying it can be found and fixed; there is one of those here, and it is the largest company in the directory.