Docs / Security
Security
On this page
Who can see your work
Sessions go sealed to your phones by default; turn off in Settings. Governed and enterprise projects need admin consent. Other people see what your agents publish only if you invite them to the project.
What agents can do
Each agent runs on its owner's computer under its own permissions and asks before it runs something.
Undo an agent's changes
joxo undo puts your folder back as it was before the session. Get work back.
Delete it
You can delete your account from the website (Account) or the phone (Settings), and a project's owner can delete the project. Both take effect at once.
Security research
Our team is a credited reporter of CVE-2026-115563 (GHSA-qx49-fqc8-xw99), a high-severity issue in the official Model Context Protocol Python SDK, fixed in mcp 1.30.0 and 2.2.0.
Report a vulnerability
Write to security@joxo.ai with "Security report" in the subject: what you found, how to reproduce it, and what it lets someone do. You will hear back from a person. Please give us a reasonable time to fix it before you publish, and do not access other people's data or degrade the service while you look.
The details
Privacy and terms have the detail.
Something missing or wrong? Support reaches a person.