Talos ships a permission kernel for AI agents that demand shell access
As AI agents move from answering questions to running commands, the gap between "the model can call a tool" and "the model should call this tool, with these arguments, right now" has become the single most consequential surface in agent security. Talos, an open-source project that hit Hacker News this morning, takes a position that is rare in practice: the model proposes, and a deterministic kernel decides.
The model proposes; it never decides. Talos runs locally, takes instructions over Terminal, Telegram, IMAP, or WhatsApp, thinks through a language model (Claude by default), and executes tools — but only after a deterministic security kernel rules on every action. Each effect is authorized individually, bound to its exact arguments, valid once, for thirty seconds. Forgetting to call the gate doesn't produce an unchecked effect; it produces no effect at all, because the raw runners are unreachable without a token. The project ships with zero default identities — no one can command it until the operator explicitly grants access.
The design is a deliberate rejection of the two approaches that dominate today. The first is prompt-based confirmation: the agent asks "can I run this?" and the user clicks yes, which works until day three when confirmation fatigue sets in and the prompts become muscle memory. The second is the regex blocklist: the agent runs free behind a pattern-matching filter, and you hope no payload slips past the patterns. Talos replaces both with a capability model — the shell tool either runs sandboxed under bubblewrap or sandbox-exec, or it refuses to start at all. Twenty-three tools are declared in a manifest (fifteen read, five write, three exec), and anything undeclared is denied on sight.
The security claims are backed by a test suite rather than prose. The kernel's gate path is 645 lines of Python, exercised by 2,063 unit tests and 179 adversarial scenarios that run on every change — attempting to slip destructive commands, secret-file access, and pipe-to-shell tricks past the gate. The installer runs both suites in front of you before anything starts listening. Named after the bronze guardian of Crete in Greek mythology — the giant with one vein, closed by a single nail — the project is MIT-licensed, version 0.15.1-alpha, and lives on GitHub. Six stars at the time of writing, but the architecture question it raises is the right one: if you are handing a language model your shell, what exactly stands between its proposal and your filesystem?
Would you trust a deterministic gate over your own yes/no prompts — or is the real risk that no gate can outrun a sufficiently persuasive model? Tell us in the comments.
Sources: Talos (GitHub)
