Omarchy 4.0.1 undoes AI agent defaults that skipped safety checks

Omarchy shipped version 4.0.1 on August 25, 2026 with 11 security fixes. The most consequential one changes how the system starts AI coding agents. Until this release, Omarchy launched Claude Code and OpenAI's Codex with the flags that turn off their approval prompts, so the agents could act without asking.

Omarchy is a ready-made Linux desktop built on Arch Linux, created by David Heinemeier Hansson of Basecamp. It first appeared in June 2025 and aims to give developers a working environment without hours of setup. Version 4.0 arrived in mid-August 2026, and this patch followed 11 days later.

What the agents were doing before

A coding agent normally pauses before it does something risky. It asks the developer to approve a shell command, a file write, or a package install. Omarchy's version 4.0 startup settings removed that pause.

Version 4.0.1 reverses it. According to the release notes, Claude and Codex now launch in auto-review mode instead of full bypass, and agent actions pass through a classifier before they run. A classifier here is a second model that inspects the proposed action and judges whether it is safe.

That is an improvement, not a guarantee. heise online's report makes the limit explicit: auto-review "is not a sandbox but a model that can be deceived." The publication points to work by the security firm PromptArmor, which showed OpenAI's review agent approving the installation of malicious packages after instructions were hidden in code.

The other fixes in the release

The release notes list fixes across seven more areas.

Area	What changed
Docker group	Adding the user to the docker group is now opt-in, not the default
Installed themes	Fixes for vulnerabilities introduced through theme files
FIDO2	Hardware security key handling patched
Git transport	Fixes in how repositories are fetched
USB devices	Safer handling of connected hardware
DNS helpers	Patched name-resolution scripts
Notification actions	Fixes to what a desktop notification is allowed to trigger

The Docker change matters for anyone who was already running the system. Membership in that group lets any program in your desktop session talk to the Docker service, which runs with full system privileges. Making it opt-in narrows what a compromised program can reach.

A security team, and $10 million behind the project

Omarchy now has a security team of its own, and a published disclosure process at omarchy.org/security. The 4.0.1 notes credit three security contributors by handle: @acrogenesis, @mdisec, and @omarchybot.

The money arrived at the same time. Both heise online and The Register report the launch of the Omacom Foundation to fund the project's infrastructure. The two accounts differ slightly on the figure. The Register says the fund opened at $8 million and reached $10 million once backers including Dropbox joined; heise online reports the launch total as $10 million. Named patrons include Tobi Lütke of Shopify, Patrick Collison of Stripe, and Michael Dell.

The foundation also intends to support the open-source projects Omarchy depends on, including the Hyprland window manager and Quickshell.

Not everyone is convinced. The Register quotes a critic who says flatly: "Do NOT use Omarchy if you care about security of your machine even a little bit."

What this means for developers

Update first, then check the group. Run groups on any machine installed from version 4.0 or earlier. If docker appears in the output, the old default is still in place on that machine. A patch changes what new installs do, not what your system already did.

The broader lesson applies well beyond one distribution. A convenience default that disables an agent's approval prompt is a security decision, and it was made here on the user's behalf without a prompt. If you package agents for a team, make the permissive mode something a person opts into and can see.

Treat auto-review as a speed bump rather than a wall. PromptArmor's result is the useful data point: a reviewing model can be talked into approving a malicious install. Where an agent can install packages or run shell commands, a container or a virtual machine still does work that no classifier does.