h/holo-desktop, uses your real desktop. It sees visible windows, clicks, types, runs shell commands, and reads and writes files. What leaves your machine depends on where the agent loop and the model run.
What H Company receives
Cloud agents such as
h/web-surfer-flash drive a browser on H’s infrastructure in every mode, so they cannot use your own model server.
The Models API keeps no prompts or screenshots by default, only request metadata (time, model, token counts). H is SOC 2 and ISO 27001 certified and runs its own models, so nothing goes to a third-party model provider.
What the agent can see
Anything on screen can end up in a screenshot: other apps and tabs, documents, chats, account names, file paths, and secrets. The terminal output and the runtime log under~/.hai/agent-runtime/logs/ can contain the same things. They stay on your machine, but review them before you share them.
When a coding agent runs holo, the host decides when to call it and what task to send. The server asks the host to confirm with the user before an agent sends, deletes, pays, or changes settings, but the host still decides, so this is not a safety boundary. Check whether the host asks before tool calls, and whether its MCP config is global or per project. The data still goes where the mode above sends it.
Before a sensitive run
- Close unrelated windows, tabs, chats, and password managers.
- Use
--localwith your own model if the task must not reach H. - Use a separate browser profile for web apps, away from your personal cookies.
- Keep the task narrow, so the agent opens fewer apps.
- Rotate any credential that showed up in shared logs or screenshots.