Talos gates every AI agent tool call behind a deterministic permission kernel

Talos, an MIT-licensed AI agent currently at version 0.15.1-alpha, has surfaced on Hacker News's front page with an unusual pitch: a deterministic permission kernel sitting between the language model and the shell. Rather than trusting the model to behave, or asking a probabilistic classifier to guess at intent, Talos routes every tool call through a small, testable policy program that must explicitly authorise each effect before it runs.

How the gate works

According to the project's site, every tool call passes the kernel before execution: each effect is authorised individually, bound to its exact arguments, valid for a single use, and expires after thirty seconds. The deciding code is a 645-line Python file, which the site calls the authoritative implementation, and effects are logged before they run rather than afterwards. Commands run sandboxed by default, via bubblewrap on Linux or sandbox-exec on macOS; where the platform provides neither, the agent refuses to run rather than proceeding unprotected.

The site publishes specimen verdicts drawn from its adversarial suite. Reading a Telegram credentials file under ~/.secrets is denied, as is using curl to POST an SSH private key to a remote host or appending to /etc/sudoers. Reading an ordinary project README is allowed. Some commands fall to an "ask" verdict: a recursive delete on a scratch directory, writing ~/.ssh/authorized_keys, or writing ~/.bashrc — the last because it executes again later.

These are not just marketing numbers: the installer runs 2063 unit tests and 179 adversarial cases in front of the user, and any adversarial failure aborts the installation.

Declared effects, no defaults

Talos exposes twenty-three tools — the manifest counts 15 read, 5 write and 3 exec — and each one declares its effect up front. Anything undeclared is refused outright. There is also no default allowlist of trusted identities: the TALOS_ALLOWED_PRINCIPALS environment variable must name an identity the operator has proven control of, or nothing starts. The project argues that shipping a default identity would effectively embed a backdoor in the source.

A confined worker, four channels

Beyond the gate, Talos can delegate bounded coding tasks to a confined Claude Code worker that builds, runs tests and — behind a double opt-in that is off by default — drives a browser inside the same sandbox, writing only to a kernel-derived disposable workspace. Completion notices sent back to the originating chat are assembled from the worker record rather than model prose, so a hallucinating or injected model cannot fabricate a status report. Generated files can be attached to chats only from kernel-derived roots, capped at 20 MB and four files, and tool output cannot forge an attachment.

The agent is reachable over four channels: terminal, Telegram, mail over IMAP, and WhatsApp through an operator-controlled broker over SSH. Every channel fetches rather than listens — Telegram long-polls and mail is pulled — so nothing opens an inbound socket. Unauthenticated mail is treated as a claim, not an identity: it may trigger questions but never approvals.

A brake without a model

Emergency commands — /stop, /undo, /autonomy 0 and /log — run deterministically with no language model in the loop. The site's reasoning is blunt: a brake that has to think first is not a brake, and a hallucinating model cannot be relied upon to shut itself down.

Stated limits

The page leads with its limits rather than burying them. Talos is not a multi-tenant security boundary; it assumes a single operator on a single machine. More pointedly, it does not defend against a malicious model — only a mistaken one, and against prompt injection arriving through tool output, which the project treats as distinct threats. Requirements are modest: Python 3.11+ and a working Claude Code CLI, with the site claiming it even runs on a Raspberry Pi. The installer script is served as plain text for review, proves its claims by running the test suites, and starts nothing — the operator starts the agent manually.

Why it matters

Most agent security today leans on the model itself: constitutional prompts, approval dialogs, or classifiers that are themselves probabilistic. Talos reframes the problem as software verification — a small deterministic program guarded by an adversarial suite that reruns on every install, with every claim on the page positioned as reproducible rather than taken on faith. That approach will not stop a genuinely malicious model, as the project itself admits, but mistaken actions and injection through tool output are the failure modes operators actually encounter day to day. Coming from a single alpha-stage source with no independent audit cited, the claims warrant scepticism. Still, the underlying pattern — capabilities declared up front, denial by default, and policy code you can test — is cheap to copy, and other agent frameworks would do well to borrow it.