Stop it: stop the macOS app (if it supervises the Gateway) or terminate your apus gateway process.
Close exposure: set gateway.bind: "loopback" (or disable Tailscale Funnel/Serve) until you understand what happened.
Freeze access: switch risky DMs/groups to dmPolicy: "disabled" / require mentions, and remove any "*" allow-all entries.
Rotate (assume compromise if secrets leaked)
Rotate Gateway auth (gateway.auth.token / gateway.auth.password). Rotation hot-applies only when the effective auth mode stays the same; set gateway.auth.mode explicitly for SecretRefs. Restart for an auth-mode change or updated process environment credentials such as APUS_GATEWAY_PASSWORD.
Rotate remote client secrets (gateway.remote.token / .password) on any machine that can call the Gateway.
Rotate provider/API credentials (WhatsApp creds, Slack/Discord tokens, model/API keys in SQLite auth stores, and encrypted secrets payload values when used).
Audit
Check Gateway logs with apus logs (or apus --profile <profile> logs for a named profile). The default path is /tmp/apus/apus-YYYY-MM-DD.log; named profiles use /tmp/apus/apus-<profile>-YYYY-MM-DD.log, unless logging.file overrides it.
Review the relevant transcript(s): ~/.apus/agents/<agentId>/sessions/*.jsonl.
Review recent config changes that could have widened access: gateway.bind, gateway.auth, DM/group policies, tools.elevated, plugin changes.
Re-run apus security audit --deep and confirm critical findings are resolved.
Collect for a report
Timestamp, gateway host OS + Apus version.
The session transcript(s) + a short log tail (after redacting).
What the attacker sent and what the agent did.
Whether the Gateway was exposed beyond loopback (LAN/Tailscale Funnel/Serve).