Security

seven attacks on agents.
what we hold, what you hold.

No model is immune to these attacks. Through OneShot, keys, payments and approvals sit outside the model, where injected text can't reach them. The risk moves from your stack to ours.

Trust Center Check a receipt yourself

ASI01Prompt injection

Injected text can't approve anything; approvals take a click.

· Google Threat IntelligencePrompt injections on the webMalicious injections on the open web rose 32% in three months.

We hold

  • Approval links are signed and single-use; opening one approves nothing.
  • In OneShot's own agent loops, pages, emails and tool output are marked as data, not instructions.
  • Email replies count as answers only from authenticated sender domains.

You hold

Treat what your agent reads as data.

ASI02Tool poisoning

Actions run through one connection you control, and their receipts are signed.

· Snykpostmark-mcp harvests emailsA copycat email tool quietly copied every message to an outside address.

We hold

  • Receipts are signed with Ed25519; anyone can check them offline against our published keys.
  • With an action policy on, an approval covers one exact action, once.
  • Organization admin and security actions are recorded and can be exported.

You hold

Install tools only from publishers you trust.

ASI03Credential theft

An agent can't leak a key it never holds.

· Wizs1ngularity: the Nx supply chain attackA malicious package ran victims' own AI coding tools to hunt secrets.

We hold

  • Our compute sandboxes hold no model or vendor keys, only a short-lived one-task token.
  • Access tokens are stored as hashes, expire after 90 days by default, and can be IP-limited or revoked at once.
  • Persona data and mailbox credentials are encrypted with keys in a cloud key service; other data is encrypted at rest; traffic uses TLS.

You hold

Give each agent its own revocable token.

ASI04Supply chain attacks

Daily backups, plus a weekly copy in a separate cloud project.

· CISAShai-Hulud compromises npmA self-spreading worm took over 500+ npm packages and stole developer keys.

We hold

  • Every change must pass the test suite before it merges; dependencies are pinned and watched for advisories.
  • The database is backed up daily, with a weekly copy in a separate cloud project.

You hold

Pin and review your own dependencies.

ASI05Remote code execution

Hostile pages are read by a service with no cloud permissions.

· PHPPHP security releaseTwo PHP flaws let anyone run code on a server without signing in.

We hold

  • Our web crawler runs as its own private service with no cloud permissions.
  • Webhooks you register can reach only public addresses, and every delivery is signed.
  • web_read never returns a site's response headers.

You hold

Patch the servers your agents talk to.

ASI09Agent hijacking

A payment authorization can't be replayed, nor an approval swapped.

· Unit 42, Palo Alto NetworksFooling AI agents22 injection techniques found on live pages; some pushed agents to pay.

We hold

  • A payment authorization works once; a replay is refused.
  • With an action policy on, an approval covers one exact action, once.
  • Approval links are signed and single-use; opening one approves nothing.

You hold

Decide which actions need a person.

ASI08Denial of wallet

A compute goal can't spend past its budget: the budget is reserved first.

· Truffle SecurityGoogle API keys weren't secrets, then Gemini changed the rulesThousands of public Google keys could suddenly bill model usage.

We hold

  • Compute goals reserve budget before they spend, and daily agent caps are checked before any payment is signed.
  • A retried call with the same quote or idempotency key is never charged twice.
  • Access tokens are stored as hashes, expire after 90 days by default, and can be IP-limited or revoked at once.

You hold

Set a budget per agent and per goal.

Also live

  • Repeated failed sign-ins lock the token out, from one minute up to a day.
  • Set a retention limit and finished content older than it is cleared every day.
  • Single sign-on and owner, admin and member roles are available; removing a member ends their sessions.
  • OneShot can run in your own cloud project, on private networking.

Check it yourself

don't trust this page. check the signature.

win.oneshotagent.com/.well-known/oneshot-receipts.jsonHow to verify a receipt

Further reading

Your security team
has questions. Good.

Visit the Trust Center Read the docs