Kilo Code

Coding agent (IDE) · Kilo · 4/7 verified · Last checked 2026-10-16

Per-tool allow, ask and deny rules with glob patterns, but most tools default to allow. An opt-in OS sandbox limits writes and blocks outbound network once it's on.

Overall: B (2.00 avg, 4/7 controls verified)

Lock this down first

Turn on the sandbox and keep Restrict Network Access on, with only the hosts you need in allowed_hosts.

Scorecard

Criterion	Rating	Notes
Permission granularity	3/3	allow, ask and deny per tool, with glob patterns on targets. Last matching rule wins.
Human approval gates	1/3	Most tools default to allow. Only .env reads and a few others prompt by default.
Sandboxing	2/3	Off by default (sandbox.enabled is false). OS-level boundary on macOS and Linux.
Secrets handling	Unverified	Not confirmed in the docs we checked.
Audit logs	Unverified	Not confirmed in the docs we checked.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	2/3	Off by default. With the sandbox on, network defaults to deny, with an allowed_hosts list.

Unverified: Secrets handling, Audit logs, Kill switch / interrupt. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.