Security | Alden

Permission before action

Every action routes through the Governance Engine before it runs, checked against Always / Ask Every Time / Never rules you set across sign-ins, browsing, and actions.

Your machine, your data

The model runs locally on your own device. Your files, your conversations, and what you ask Alden to do stay on your machine rather than being sent anywhere for processing.

Bounded file access

Alden creates a folder called AldenWorkspace on your Desktop during setup. Put the files you want it to work on there. Alden reads what you place in that folder; it does not go looking elsewhere on your Mac. If you skip this during setup you can create it later, in Settings → Permissions.

What Alden asks your Mac for

macOS makes an app ask before it can reach anything sensitive, and every prompt you see comes with a reason. This is the complete list.

Microphone — the wake word and voice commands. Asked during onboarding.
Camera — hand gestures, which are optional. Asked during onboarding.
Accessibility — controlling app windows on your behalf. Asked during onboarding.
Automation — driving Mail, WhatsApp and Messages when you ask Alden to. Asked during onboarding.
Desktop (Files & Folders) — creating the AldenWorkspace folder. Asked at the end of onboarding.

What matters as much is the list Alden never asks for:

Full Disk Access — not requested, because nothing Alden does needs it. When Alden reads your email it asks Mail for it, the same way you would, rather than opening Mail’s database. It does not touch Messages’ message store, Safari history, or any other app’s private storage.
Your photo library — not requested.
Contacts, Calendar, Reminders and Location — not requested.

Declining any of them is allowed. The feature that needed it stops working. Everything else carries on, and you can grant it later from Settings → Permissions.

The threat model

Alden is unusual among assistants: it runs on your own machine, holds the keys to your accounts, and can act without you watching. That shapes what we defend against.

The model runs locally by default, so the usual risk of a cloud assistant, your prompts and files sitting on someone else's servers, does not apply.

A second question replaces the one that no longer applies, and it is the harder one: what can software on your machine be talked into doing? The Governance Engine exists for exactly that.

What Alden can and cannot reach

Files. Only what's in your Workspace folder, or granted explicitly. The rest of your drive is off-limits, so a prompt that tries to read elsewhere fails rather than succeeds quietly.
Sites. Signing in follows per-site rules you set. A site you never authorised isn't reachable just because a task mentions it.
Actions that leave the conversation. Sending mail, moving files, purchases: each follows its own Always / Ask Every Time / Never rule.
Never bypassed. CAPTCHAs and legal agreements always come back to you, and payments wait for spoken confirmation. Neither is configurable, so neither can be turned off by a task, a prompt, or a setting you forgot.

Prompt injection

An assistant that reads web pages and email can be fed instructions by the content it reads. We treat that as a real attack, not a curiosity. The mitigation isn't cleverness about spotting malicious text, it's that the consequential actions are gated regardless of what convinced Alden to attempt them. Injected text can't grant itself file access or approve its own payment.

Reporting a vulnerability

Report to alden@quantintelligence.co with "Security" in the subject, and give us a chance to fix it before disclosing publicly.

What helps most, specific to Alden:

Your operating system and the Alden version.
The permission rules that were configured at the time, since behaviour depends on them.
Whether an approval prompt appeared, and what it said.
For anything involving injected instructions, the page or message that carried them.
The relevant entry from the action log, which records what was actually attempted.

Please don't test against other people's accounts or data. We won't pursue researchers acting in good faith within that boundary. We don't run a paid bounty programme today; this page will say so if that changes.

Your data

What's collected and how long it's kept is in Alden's privacy policy. The developer API is served by our infrastructure rather than your machine, and is covered separately there.