PewDiePie's Odysseus got the perimeter right and the agent sandbox wrong
Odysseus crossed 67,000 GitHub stars in under two weeks. That’s the kind of number that makes people stop thinking, and most of the coverage I’ve read proves it — half of it treats the project as a privacy revolution, the other half as a celebrity stunt. Both miss what’s actually on the page.
Felix Kjellberg shipped a real piece of software. Competent enough that the interesting questions are engineering questions, not culture-war ones. Two of them decide whether you should run it: where is it safe, and where isn’t it. A third decides whether anyone building on top of it is wasting their time.
Start with the one nobody got right.
The license is AGPL, not MIT
I keep seeing “MIT-licensed” in writeups. It’s wrong, and it’s not a small mistake. Open the LICENSE file and the README footer: Odysseus is AGPL-3.0-or-later.
AGPL is the strong-copyleft license with the network clause. If you host a modified version and let other people reach it over a network, you owe them your modified source — running it as a service counts as distribution. MIT lets you fork it, close it, and sell it. AGPL exists specifically to stop that.
Which is why the “trillion dollar project” framing is a joke at the engineering level. You don’t pick AGPL when you’re trying to build a moat. You pick it when you want to guarantee nobody — including a future, richer competitor — can take your work private and resell it. The license is a values statement, not a business plan, and every post calling it MIT got the single most consequential fact about the repo backwards.
What it actually is
The feature tour has been done to death, so I’ll keep it to what changes your risk calculus. FastAPI and Python backend, Docker Compose, the whole thing wired together with ChromaDB for vector memory, SearXNG for search, and ntfy for notifications bundled in. The agent is built on opencode. The model-recommendation tool (Cookbook) sits on llmfit. Deep Research is adapted from Alibaba’s Tongyi DeepResearch.
If you already run Open WebUI, you understand most of the surface area on sight. The real difference is that Odysseus bolts email, calendar, notes, and scheduled agent tasks into the same box as the chat and the shell. Hold that thought — it’s the entire problem.
What it gets right
This is where I expected to be harsh and wasn’t.
The network defaults are sane. It binds to 127.0.0.1, auth is on out of the box, the loopback auth-bypass is off by default, and the shell, Python, and file tools are admin-gated — a non-admin account gets none of them. The docs walk you through HTTPS-behind-a-reverse-proxy and tell you, in plain language, to treat the whole thing like an admin console. That’s exactly the right framing.
And it ships a THREAT_MODEL.md. Most self-hosted AI projects ship a feature list and a Discord link. Writing down your own attack surface is rare, and it means a careless user running docker compose up on a laptop won’t get owned by the defaults alone. Credit where it’s earned: the perimeter is better than the average project at this maturity, and far better than the hype implied either way.
What it gets wrong
The agent’s shell tool has no sandbox. It runs with the full permissions of the process user. No filesystem jail, no container-within-the-container, no seccomp profile — nothing between the model’s tool calls and your home directory.
On its own, that’s a known tradeoff. Every agent with a real shell is a loaded gun. What makes the Odysseus version worse is the company it keeps. The same agent that can run bash also does email triage, runs cron-style scheduled tasks, and pulls in web research. Email is attacker-controlled input. Web pages are attacker-controlled input. So the path is short and obvious: a crafted email lands in your inbox, the agent reads it during “triage,” and that untrusted text is now flowing toward a shell that runs as you. Classic prompt injection, except the payload doesn’t print a poem — it executes.
The threat model documents this honestly. That’s to its credit, but a documented gun is still loaded. Disclosure isn’t mitigation, and right now there’s no real mitigation in the box — just admin-gating, which protects you from other users, not from the agent you yourself enabled acting on input you never wrote.
So should you run it?
If you already run a local stack, the thing Odysseus adds isn’t the chat — it’s the email-calendar-agent glue. Worth a look. Not worth your real credentials.
If you do run it: keep it on loopback, reach it remotely only through your own reverse proxy or a private mesh like Tailscale, run the container as a dedicated non-root user, and do not connect an email account you’d mind losing. Treat the agent’s shell tool as what it is: remote code execution you opted into, triggered by an LLM reading text you don’t control.
The hype says Odysseus is about privacy. It isn’t. It’s about whether you trust a language model with a shell on input you didn’t write. The honest answer today is no — not with anything you can’t afford to lose.
I’m done reading the threat model. Next I’m going to break it: Odysseus running on real homelab hardware, the agent shell tool fed inputs it shouldn’t trust, actual numbers on the bundled models, and whether the sandbox gap is as ugly in practice as it looks on paper. That one’s hands-on.