Threadwright gives an AI agent (Claude Code) full, unattended control of the machine it runs on: mouse/keyboard input, file read/write, process control, and (by default, Claude.PermissionMode = bypassPermissions) unrestricted shell command execution — all triggered by messages from a Telegram chat.

This is not a sandbox. Treat it like giving someone SSH + physical access to your desktop:

• Only run it on a machine you own and are comfortable with an LLM having full control over.
• Always set Telegram.AllowedUserIds. An empty list fails closed (bot ignores everyone), but a misconfigured or leaked bot token otherwise lets anyone in the chat drive your PC.
• Code and secrets transit Telegram, a third-party service. ProtectSecrets (on by default) scrubs known secret values from outbound messages — this is defence-in-depth, not a guarantee. Don't run this against a machine holding secrets you can't rotate, or point it at repos with data you can't afford to leak through your own Telegram account.
• bypassPermissions is the default because unattended sessions need it to not stall on approval prompts. Switch to acceptEdits + an explicit Claude.AllowedTools whitelist if you want a narrower blast radius.

If you find a security issue in Threadwright itself (not in Claude Code or Telegram, which are third-party dependencies), please open a private report:

• GitHub → Security tab → Report a vulnerability, or
• email the address on the maintainer's GitHub profile.

Please don't open a public issue for anything that could let someone control another user's machine or exfiltrate their credentials. Everything else (crashes, bad UX, non-security bugs) — regular issues are fine.