Qwen Code

Qwen Code runs as the user who launched it and keeps that full authority. Shell commands, MCP servers, and even the opt-in sandbox receive the whole parent environment; the only variables removed are four Qwen-internal daemon tokens, so model API keys, GitHub tokens, and cloud credentials reach every command the agent runs. There is no per-tool identity or authorization layer, so a hijacked session can do anything the user's credentials allow.

By default Qwen Code runs in AUTO mode: edits inside the workspace and read-only tools are approved automatically, and everything else, including shell commands, web fetches, and MCP calls, is approved or blocked by an LLM classifier with no human involved unless the classifier blocks twice or fails. A small regex list hard-blocks a few destructive git and IaC commands. Because folder trust is off by default, repository settings are trusted as-is, and the gate is not tamper-resistant against repository settings. Manual per-call approval, which shows the exact command or diff, exists but must be chosen by the user.

The main tool is a raw shell that accepts any command string. File tools take typed, absolute paths and AUTO mode resolves symlinks to keep auto-approved edits inside the workspace, but writes outside it are allowed once approved, and web_fetch deliberately allows localhost and private addresses. All tools, including shell, write, and network tools, are enabled by default; individual tools can be denied by rule.

By default every shell command the model writes runs directly on the host as the user, with the user's full environment. Qwen Code ships two opt-in sandboxes: an operator-only bubblewrap/Landlock execution sandbox (read-only root, workspace writes, optional network cut-off) and a container sandbox, but both are off unless configured. Even when on, the bwrap sandbox leaves the home directory readable and passes the full environment, including API keys, into the sandbox, and MCP servers and hooks still run on the host.

If a web page, file, or tool result hijacks the model, the only things standing between it and real damage are the AUTO-mode LLM classifier and a short regex list of destructive git/IaC commands. The classifier is built carefully, it never sees tool results or the agent's own text, and it falls back to a human when it fails, but it is still a model making a judgement, and when it allows a call nobody is asked. In the default configuration a hijacked session can read files anywhere on disk without a prompt and could exfiltrate them or push code through classifier-approved commands. Workspace content can also weaken the classifier gate.

Folder trust is off by default, so Qwen Code treats every directory as trusted. A cloned repository's .qwen/settings.json is merged into the session without a prompt, and it can change security-relevant settings; a project .env can also fill in model endpoint variables such as OPENAI_BASE_URL. Project MCP servers are the exception: they need an approval that is bound to a hash of their config. Managed auto-memory is on by default and extracts memories from conversations into a per-project store that is re-injected in later sessions.

Extensions, plugins and MCP servers are not enabled by default and installing an extension shows a consent screen that lists the MCP commands it will run. Nothing verifies that what runs is what was approved: extensions come from git, GitHub releases or npm without hash checks, and user-configured MCP servers launch whatever their command resolves to at each start. Project MCP servers do need re-approval when their config changes. Every extension process runs as the user with the full environment, including API keys.

Credentials are stored in plaintext files with owner-only permissions, and some error paths and the team-memory writer redact or scan for secrets. But the shell, MCP servers and the sandbox all inherit model API keys and every other secret in the environment, nothing scans tool output for secrets before it is sent to the model provider, and the agent can read credential files outside the workspace without a prompt in AUTO mode. Usage statistics are sent to Qwen by default; they carry tool names, decisions and error messages rather than prompts.

Every session is recorded by default as an append-only JSONL transcript under ~/.qwen, including tool calls and their results, and sub-agents keep their own transcripts. The record lives outside the workspace but in a directory the agent's own shell can edit, it does not attribute approvals to a human versus the classifier in a verified way, and writes are queued rather than guaranteed before an action runs. OpenTelemetry export exists but is opt-in.

Each prompt is capped at 100 model turns and foreground shell commands time out after two minutes (at most ten), and cancelling kills the shell's process group. There is no session turn limit, token or cost cap by default, background shell tasks have no time limit, sub-agents get their own turn budgets, and the model can create durable cron jobs that keep firing after the current task.