Checked 13 October 2026
Security
Omarchy 4.0.1, released 25 August 2026, is titled as a fast follow of security fixes "validated and examined by the new Omarchy Security team." The list is the project's own. The bugs are the kind shell tutorials warn about: untrusted text interpolated into a command.
What 4.0.1 closed
The release notes, written up by DHH in the 4.0.1 pull request, include these security items:
| Fix | What had been shipping |
|---|---|
| #7001, by DHH. Launch Claude and Codex with auto-review instead of full bypass. | The menu and keybinding launched Claude with bypassPermissions and Codex with --dangerously-bypass-approvals-and-sandbox. DHH's pull request says that Codex flag's own help text is for externally sandboxed environments. The replacement still runs unattended: Claude's auto mode, Codex's --approve-for-me. The commit says Grok stays on bypassPermissions. The pull request is marked "Generated with Claude Code." |
| #7847. Stop a video title from becoming the Download Video play command. | A hostile video title could be written into the command that played the download. The researcher named in the follow-up patch is Mehmet İnce, who is also on the Omarchy security team. |
| #7926, by Ryan R. Hughes. Run notification click actions as an argument vector. | Clicking a notification interpolated a command string. One slip was remote code execution: a forged video title became an mpv option when the "download complete" toast was clicked. Hughes's patch description says safety had depended on every caller quoting perfectly. |
| #7884. Stop an installed theme from running code. | Installing a theme, the feature the homepage uses to "change everything," could execute code. |
| #8129. Stop USB device names from being executed as Hyprland Lua. | A USB device name was passed into the compositor as Lua. The device name is chosen by whatever is on the other end of the cable. |
| #8056. Don't put the user in the docker group. Make it opt-in. | From 1 June 2025 until 24 August 2026 the default user was a member of the docker group. The Docker daemon runs as root and listens on a socket that group can use. Any process in the desktop session could reach it. A writeup by 0xcc demonstrated reading /etc/shadow from a normal user process, with no sudo prompt. The group membership was added, briefly removed the next day, restored on 17 June 2025, and left in place for fourteen months. Versions before 4.0.1 are affected, including the last 3.x ISO, 3.8.4. |
#7904. Stop FIDO2 setup staging its auth file at a predictable /tmp path. |
Hardware-key enrollment wrote credential material to a fixed temporary path. |
#8172. Pin a trusted PATH in a privileged DNS helper. |
A helper that runs with privilege inherited the caller's PATH, so a planted binary earlier on the path could run as root. |
| #8046. Remove the sudo lockout reset command. | The helper that reset a sudo lockout was itself an injection bug. The project deleted it. |
| #8067 and #8174. Git transports. | Plugin install could be pointed at a git transport-helper URL. A second patch refuses git transports Omarchy does not clone from. |
Happy Fellow's 25 August 2026 post "Merchants of Insecurity" made the process point: the project glues the desktop together with shell scripts, some of them generated, and then speedruns bugs the industry has known how to avoid for decades. The 4.0.1 notes are the project's confirmation that the bugs were real. Several of the patches add quoting or an argument vector on top of the same design. The notification patch is the one that removes the shell from that path.
On 2 October 2026 the foundation announced a $100,000 HackerOne bounty pool. That is six weeks after 4.0.1 and after the public writeups. A bounty pays the next person who finds the next script. It does not rewrite the scripts that already shipped.
The manual, after the fixes
The security chapter still begins: "Omarchy takes security extremely seriously." The controls it lists are full-disk encryption, a default-deny firewall with LocalSend left open on port 53317, Arch's rolling updates ("you're always running the latest, most secure versions of everything"), Omarchy's own package mirror, and Cloudflare in front of the distribution infrastructure.
Then the same chapter documents passwordless sudo:
Sometimes you want
sudoto stop asking, most often when an AI agent is doing a long stretch of system work for you.
The menu item lasts 15 minutes by default. The command accepts a number from 1 to 1,440, which is a full day. The manual's own warning:
Be clear-eyed about this one: while it’s on, anything running as your user can do anything as root without being asked. That’s the whole point, and it’s also the whole risk.
The agent chapter matches it. Launches "run unattended in their respective don’t-stop-to-ask modes, so be ready for them to actually do things." Aliases c, cx, and cy start OpenCode, Claude Code, and Codex in auto-approving modes. The feature that makes the operating system "malleable" is an agent with a standing grant to change it, on a machine whose convenience switch is a blank check for root.
The firewall note about Docker is about containers being reachable from the network (ufw-docker). The 4.0.1 docker-group bug was a different fact: membership in the group is root on the host. A reader of the manual could come away thinking Docker had been locked down. The group membership said otherwise, for fourteen months.
Passwords and the lock
increase-sudo-tries.sh sets ten sudo attempts and ten faillock denials. The comment in the file calls three attempts a problem for fat fingers. Marius, on the 3.0.2 installer, also found that a passphrase of install was accepted for both the user and the disk encryption. Full-disk encryption protects a stolen laptop from someone who does not have the passphrase. It does not protect a laptop whose owner was told the word "install" was a fine passphrase, or whose agent has been handed passwordless sudo for the afternoon.
On the screensaver: Marius found the idle "lock" was a full-screen terminal animation, with hyprlock on a longer timer, and a mouse that could not dismiss the animation. That reads as a lock to someone who does not know the difference. A July 2026 bug report against 3.8.3 showed the shipped idle config starting that screensaver at 150 seconds and the real lock at 152 seconds, so the animation lived for about two seconds and was then killed. Later reports describe the lock screen flashing the desktop during the handoff. The manual's promise is a laptop you can lose. The implementation history is a screensaver, a race, and a lock screen that has had authentication bugs of its own, including a missing PAM file for hyprlock that made the correct password fail.
Who wrote the glue
DHH's 3 September 2026 post is the cleanest primary source. Quattro "has almost exclusively been built by agents," and the reason given is that agents are good at bash. The 4.0.1 security pull request that narrowed Claude and Codex was itself co-authored by Claude. ThePrimeagen joined Omarchy Core on 26 September 2026 to lead "Agentic QA," with a harness he named Oligarchy: virtual machines, synthetic keystrokes, screenshots, a fleet of clients. The announcement says no human QA team could click through every plugin and theme. The 4.0.1 bugs were not missed clicks. They were strings concatenated into shells. A screenshot of a happy desktop does not show that.
Marius's review of the migration scripts describes the maintenance model under the agents. Configuration changes are bash files, run in order, often with sed -i against a fixed path. They are not idempotent. The installer sets set -e, then runs migrations in a subshell that does not inherit it, so a failed command does not stop the next command. A theme directory with a space in the name was enough, in his test, to break the theme switcher. That is ordinary shell hygiene. It is also the layer the homepage tells an agent to rewrite.
Hyprland
Hyprland is one of the three pieces Omarchy names as the desktop (Arch, Hyprland, Quickshell). The Omacom Foundation's first announced spending was an exclusive, multi-year sponsorship of Hyprland's author, Vaxry, taking over in October 2026. In April 2024 freedesktop.org banned Vaxry from its community after a conduct dispute. He published the email thread. Drew DeVault, writing up the ban, described years of public behavior by Hyprland's leadership and the threats in that thread, including a threat of legal action against the conduct team. Omarchy's doctrine rejects codes of conduct in the same season it makes that compositor a paid pillar of the distribution.
Hyprland has also had a standing reputation, among distributors, for code that other desktops refuse to ship lightly. A Gentoo bug and a long xdg-desktop-portal-hyprland thread are the citations Marius used. This page does not rest on those threads. The sponsorship post is enough: the foundation called Vaxry "the most cracked Linux kid in Poland," thanked 37signals (DHH: "hello self!"), and added a parenthetical that the deal "does not include any direct assistance in getting Vaxry a girlfriend."