Show HN: Talos – An AI agent with a permission kernel between model and shell | Hacker News Reader

Show HN: Talos – An AI agent with a permission kernel between model and shell

talos-agent.ch

14 pointskurdman_00710 comments

The world badly needs more options for running agents securely. I applaud you for making an attempt. But this landing page does nothing to win my trust. The copy is full of LLM-style language that is at best off-putting and at worst impenetrable. Even your comment in this thread looks like it was written by an LLM. If you don't care enough even to describe the thing yourself, why should we trust that you care enough to make the thing work well?

Fair hit. I did lean on AI for the copy, and it shows - that's on me, and I'll rewrite the landing page in my own words. The engineering underneath is not vibed though: the policy kernel is ~645 lines you can read in one sitting, and every number on the site (2063 tests, 179/179 adversarial cases) is enforced by CI, not marketing. Judge the code, not my copywriting.

Bahahaha, come on man. The Claudish is so obvious it hurts.

Doubt you even read your own “645 line policy kernel.” Can you explain what that is and how it works in YOUR OWN words? If you paste Claude at us again we’re gonna know.

Have been developing and using a similar thing myself:

https://github.com/kamyar/ozm - Oberzugriffsmeister (“chief access master”)

Still some rough edges, and definitely not security audited. :)

In essence: All commands are routed through ozm, which has a per project and global allow list and block list.

Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.

Trademark C&D in 3, 2, 1...

A permission kernel for agents seems like the right abstraction. Natural-language guardrails are useful as instructions, but consequential authority needs to be enforced outside the model.

Thanks - that's exactly the bet. Instructions live in the context window, and anything in the context window can be argued with. The kernel can't be, because it isn't part of the conversation.

I run my agents on talos... But not this talos

In some adversarial testing of LLMs, you can see the models already performing some of these checks automatically now. Like, if you ask an agent powered by the gpt-5.6 family to `curl | sh` in an innocent context, the gpt-5.6 family will drive a trajectory that validates this script before running it -- something quite analogous to your `curl | less` example. I had to go through a lot of obfuscation in order to get a model to execute untrusted code with any regularity. I predict they'll keep making this even better. The Claude Code guy recently talked about how much better Anthropic models are becoming against this. [1]

But, even if these attacks work .001% of the time, we will still need tools like these for higher assurance work.

That being said, I would never use this one, because OP is using AI slop everywhere, so I assume the product is totally vibed, and offers little in the way of new insights into the problem space.

[1] https://x.com/bcherny/status/2086520950259118464

Hi HN — maker here. I built Talos because I wanted to hand an agent a terminal without handing it my trust model. Every tool call (read, write, exec, delegate) passes a small deterministic kernel, ~645 lines of Python, that returns allow, needs-human or deny. Unattended runs can't ask, so needs-human becomes deny. The agent can never grant itself anything.

Around that kernel: 23 gated tools, a UID-separated worker for delegated code, MCP servers confined to that worker from an operator-owned registry (no marketplace, no third-party code in the agent process), a hash-chained audit log, Ed25519-signed updates verified before anything unpacks, and a read-only live dashboard that has no approve button, by design.

Numbers the CI enforces on every page of the site: 2063 tests, 179/179 adversarial cases, 645 kernel lines, 0 inbound ports. The site has a browser reimplementation of the policy kernel you can poke at without installing anything, a replayed real session, and an honest comparison to OpenClaw and Hermes — including what Talos doesn't have (breadth; that's doctrine, not backlog).

Happy to answer anything — especially the parts where the design is wrong.

Site: https://talos-agent.ch — Source (MIT): https://github.com/talos-kernel/talos

Reply on news.ycombinator.com