Goose Trial
Overview
Goose is an open source AI agent for the terminal and desktop with recipes, extensions, and local or remote model support, created by Block and since December 2025 hosted by the Linux Foundation's Agentic AI Foundation (AAIF) (goose docs, AAIF announcement).
Trial for power users automating repo tasks via recipes. Treat recipe sharing like code: review, sign, and version control. The repository has moved from block/goose to aaif-goose/goose (goose GitHub).
Adoption Signals
- Foundation governance: goose is one of the three founding projects of the Linux Foundation's Agentic AI Foundation, announced on 9 December 2025 together with Anthropic's MCP and OpenAI's AGENTS.md (Linux Foundation press release).
- Large internal deployment: according to Block's CISO, goose is used by nearly all of Block's roughly 12,000 employees and connects to company systems such as Google accounts and Square payments (The Register).
- Community and release cadence: about 54,800 GitHub stars and 6,300 forks under Apache-2.0, with v1.52.0 released on 23 September 2026 (goose GitHub, goose releases).
- Reference host for MCP work: the AAIF describes goose as a proving ground where experimental MCP ideas such as MCP Apps, Code Mode, and the Agent Client Protocol (ACP) are shipped to real users first (AAIF blog).
- Published security hardening: after an internal red-team exercise, Block shipped recipe transparency, zero-width character stripping, and prompt injection detection into goose (Block engineering blog).
Risks
- Poisoned recipes and untrusted context. In Block's "Operation Pale Fire" red team exercise, early campaigns hid zero-width-Unicode prompt injections in Google Calendar invites; a later campaign got a goose developer to open a poisoned recipe that started an infostealer (Block engineering blog, The Register).
- Opt-in, best-effort detection. Prompt injection detection must be switched on, catches known patterns only, and its ML-based mode sends tool content and messages to an external endpoint, which needs a data-protection review (Prompt injection detection).
- Local blast radius. The agent executes shell commands and edits files with the developer's own permissions and tokens; without a container or VM boundary, one bad tool call reaches everything the developer can reach.
- Fast-moving surface. Several releases per month, a repository move, and early adoption of draft MCP features mean extensions and recipes need re-testing after upgrades (goose releases).
Pros & Cons
Advantages
- Vendor-neutral governance: Block contributed goose to the Linux Foundation's Agentic AI Foundation in December 2025 alongside MCP and AGENTS.md, and the code is Apache-2.0 licensed, which lowers lock-in risk compared with single-vendor agents.
- Model-agnostic and MCP-native: goose works with 15+ LLM providers and more than 70 MCP extensions, so one agent can run against a company-approved model gateway or a local model instead of a fixed SaaS backend.
- Proven at scale inside Block, where it is used by nearly all of the roughly 12,000 employees, and backed by an active release cadence (v1.52.0 on 23 September 2026).
Disadvantages
- Block's own red team compromised an employee laptop through a poisoned goose recipe with invisible-Unicode prompt injection (published January 2026), so shared recipes and connected data sources are a real attack path.
- Prompt injection detection exists but is opt-in, pattern-based, and documented as "a safeguard, not a guarantee"; its ML mode sends tool content to external endpoints.
- Goose runs with the user's local permissions and credentials, so containment, secret handling, and model spend have to be set up by the adopting team rather than inherited from a managed platform.
Recommendation
Trial goose with engineers and platform teams who want an open, model-agnostic agent that they can point at an approved model gateway or a local model. Start with a curated set of MCP extensions, turn on prompt injection detection (pattern mode first; the ML mode only after a data-protection review), and run the agent in a dev container or VM with scoped, short-lived tokens rather than on a workstation holding production credentials.
Treat recipes as code: keep them in a reviewed repository, block installs from arbitrary links, and include recipes and calendar or email connectors in threat modelling. Compare goose against the terminal agents already in use (Claude Code, OpenCode, Gemini CLI) on the same tasks before standardizing; the AAIF governance is the main differentiator for teams that want to avoid depending on a single model vendor.
Sources
Consulting
From radar to implementation
You have assessed the technologies — we help you bring them into production systems safely and measurably.
