The world badly needs more options for running agents securely. I applaud you for making an attempt. But this landing page does nothing to win my trust. The copy is full of LLM-style language that is at best off-putting and at worst impenetrable. Even your comment in this thread looks like it was written by an LLM. If you don't care enough even to describe the thing yourself, why should we trust that you care enough to make the thing work well?
In some adversarial testing of LLMs, you can see the models already performing some of these checks automatically now. Like, if you ask an agent powered by the gpt-5.6 family to `curl | sh` in an innocent context, the gpt-5.6 family will drive a trajectory that validates this script before running it -- something quite analogous to your `curl | less` example. I had to go through a lot of obfuscation in order to get a model to execute untrusted code with any regularity. I predict they'll keep making this even better. The Claude Code guy recently talked about how much better Anthropic models are becoming against this. [1]
But, even if these attacks work .001% of the time, we will still need tools like these for higher assurance work.
That being said, I would never use this one, because OP is using AI slop everywhere, so I assume the product is totally vibed, and offers little in the way of new insights into the problem space.
Hi HN — maker here. I built Talos because I wanted to hand an agent a terminal without handing it my trust model. Every tool call (read, write, exec, delegate) passes a small deterministic kernel, ~645 lines of Python, that returns allow, needs-human or deny. Unattended runs can't ask, so needs-human becomes deny. The agent can never grant itself anything.
Around that kernel: 23 gated tools, a UID-separated worker for delegated code, MCP servers confined to that worker from an operator-owned registry (no marketplace, no third-party code in the agent process), a hash-chained audit log, Ed25519-signed updates verified before anything unpacks, and a read-only live dashboard that has no approve button, by design.
Numbers the CI enforces on every page of the site: 2063 tests, 179/179 adversarial cases, 645 kernel lines, 0 inbound ports. The site has a browser reimplementation of the policy kernel you can poke at without installing anything, a replayed real session, and an honest comparison to OpenClaw and Hermes — including what Talos doesn't have (breadth; that's doctrine, not backlog).
Happy to answer anything — especially the parts where the design is wrong.
The world badly needs more options for running agents securely. I applaud you for making an attempt. But this landing page does nothing to win my trust. The copy is full of LLM-style language that is at best off-putting and at worst impenetrable. Even your comment in this thread looks like it was written by an LLM. If you don't care enough even to describe the thing yourself, why should we trust that you care enough to make the thing work well?
In some adversarial testing of LLMs, you can see the models already performing some of these checks automatically now. Like, if you ask an agent powered by the gpt-5.6 family to `curl | sh` in an innocent context, the gpt-5.6 family will drive a trajectory that validates this script before running it -- something quite analogous to your `curl | less` example. I had to go through a lot of obfuscation in order to get a model to execute untrusted code with any regularity. I predict they'll keep making this even better. The Claude Code guy recently talked about how much better Anthropic models are becoming against this. [1]
But, even if these attacks work .001% of the time, we will still need tools like these for higher assurance work.
That being said, I would never use this one, because OP is using AI slop everywhere, so I assume the product is totally vibed, and offers little in the way of new insights into the problem space.
[1] https://x.com/bcherny/status/2086520950259118464
I run my agents on talos... But not this talos
Trademark C&D in 3, 2, 1...
Hi HN — maker here. I built Talos because I wanted to hand an agent a terminal without handing it my trust model. Every tool call (read, write, exec, delegate) passes a small deterministic kernel, ~645 lines of Python, that returns allow, needs-human or deny. Unattended runs can't ask, so needs-human becomes deny. The agent can never grant itself anything.
Around that kernel: 23 gated tools, a UID-separated worker for delegated code, MCP servers confined to that worker from an operator-owned registry (no marketplace, no third-party code in the agent process), a hash-chained audit log, Ed25519-signed updates verified before anything unpacks, and a read-only live dashboard that has no approve button, by design.
Numbers the CI enforces on every page of the site: 2063 tests, 179/179 adversarial cases, 645 kernel lines, 0 inbound ports. The site has a browser reimplementation of the policy kernel you can poke at without installing anything, a replayed real session, and an honest comparison to OpenClaw and Hermes — including what Talos doesn't have (breadth; that's doctrine, not backlog).
Happy to answer anything — especially the parts where the design is wrong.
Site: https://talos-agent.ch — Source (MIT): https://github.com/talos-kernel/talos