X gets some scrutiny - it now runs with no user-to-hardware access on lots of hardware, and with restricted user-to-hardware access on most everything (for more information, look at machdep.allowaperture.)
Window managers aren't common sources of vulnerabilities, but there are two in base (an older fvwm, and cwm [EDIT: and twm]).
The real problem, of course, is that you probably want a browser. Even with OpenBSD's hardening and secure defaults (-current takes some steps towards not hooking up gstreamer-plugins[-good] to the internet), browsers are plenty scary.
Window managers aren't common sources of vulnerabilities, but there are two in base (an older fvwm, and cwm [EDIT: and twm]).
The real problem, of course, is that you probably want a browser. Even with OpenBSD's hardening and secure defaults (-current takes some steps towards not hooking up gstreamer-plugins[-good] to the internet), browsers are plenty scary.