Skip to content

docs: clarify macOS sandbox feature was removed in post-v1.25.0 cleanup #10900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
angiejones merged 1 commit into from
Aug 3, 2026
+10 −8
Merged

docs: clarify macOS sandbox feature was removed in post-v1.25.0 cleanup #10900

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions documentation/blog/2026-02-23-goose-v1-25-0/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,20 @@ Let's break down what's new.

## 🔒 macOS Sandboxing

**The headline feature of v1.25.0 is security sandboxing for goose Desktop on macOS.**
:::danger Outdated
The macOS seatbelt sandbox described in this section was experimental and has been removed. The `goose` server process (which executes tools) runs with the same permissions as your user account and is **not** sandboxed at the OS level. For security controls, see [`GOOSE_MODE`](/docs/guides/environment-variables#tool-configuration) (`approve`, `smart_approve`) to restrict what tools can run without confirmation.
:::

When you give an AI agent access to your shell and file system, trust matters. With this release, goose Desktop now runs inside a macOS sandbox powered by [seatbelt](https://github.com/michaelneale/agent-seatbelt-sandbox), the same underlying technology Apple uses to sandbox its own apps.
**The headline feature of v1.25.0 was optional security sandboxing for goose Desktop on macOS.**

What does this mean in practice?
goose Desktop added an opt-in macOS sandbox (enabled via `GOOSE_SANDBOX=true`) powered by [seatbelt](https://github.com/michaelneale/agent-seatbelt-sandbox), the same underlying technology Apple uses to sandbox its own apps.

- **File system restrictions:** goose can be limited in what directories it can read and write, preventing it from modifying its own config or accessing sensitive areas outside your project.
- **Network visibility:** You can track and limit what URLs goose accesses.
- **Zero overhead:** The sandbox uses macOS's built-in `sandbox-exec` facility, so there's no performance penalty.
- **Works with any tools:** Because sandboxing happens at the OS level, it applies regardless of which MCP extensions or tools goose is using.
What it provided at the time:

This is a great starting point for defense-in-depth security. The sandbox checks for `/usr/bin/sandbox-exec` on macOS and applies restrictions transparently. It's lightweight, proven, and something we'll continue to improve.
- **File system restrictions:** goose could be limited in what directories it reads and writes, preventing it from modifying its own config or accessing sensitive areas outside your project.
- **Network visibility:** You could track and limit what URLs goose accessed.
- **Zero overhead:** The sandbox used macOS's built-in `sandbox-exec` facility, so there was no performance penalty.
- **Works with any tools:** Because sandboxing happened at the OS level, it applied regardless of which MCP extensions or tools goose was using.

## 🧩 Unified Summon Extension

Expand Down