The world badly needs more options for running agents securely. I applaud you for making an attempt. But this landing page does nothing to win my trust. The copy is full of LLM-style language that is at best off-putting and at worst impenetrable. Even your comment in this thread looks like it was written by an LLM. If you don't care enough even to describe the thing yourself, why should we trust that you care enough to make the thing work well?
In some adversarial testing of LLMs, you can see the models already performing some of these checks automatically now. Like, if you ask an agent powered by the gpt-5.6 family to `curl | sh` in an innocent context, the gpt-5.6 family will drive a trajectory that validates this script before running it -- something quite analogous to your `curl | less` example. I had to go through a lot of obfuscation in order to get a model to execute untrusted code with any regularity. I predict they'll keep making this even better. The Claude Code guy recently talked about how much better Anthropic models are becoming against this. [1]
But, even if these attacks work .001% of the time, we will still need tools like these for higher assurance work.
That being said, I would never use this one, because OP is using AI slop everywhere, so I assume the product is totally vibed, and offers little in the way of new insights into the problem space.
A permission kernel for agents seems like the right abstraction. Natural-language guardrails are useful as instructions, but consequential authority needs to be enforced outside the model.
Thanks - that's exactly the bet. Instructions live in the context window, and anything in the context window can be argued with. The kernel can't be, because it isn't part of the conversation.
Still some rough edges, and definitely not security audited. :)
In essence: All commands are routed through ozm, which has a per project and global allow list and block list.
Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.
17 comments
[ 5.6 ms ] story [ 56.2 ms ] threadBut, even if these attacks work .001% of the time, we will still need tools like these for higher assurance work.
That being said, I would never use this one, because OP is using AI slop everywhere, so I assume the product is totally vibed, and offers little in the way of new insights into the problem space.
[1] https://x.com/bcherny/status/2086520950259118464
https://github.com/kamyar/ozm - Oberzugriffsmeister (“chief access master”)
Still some rough edges, and definitely not security audited. :)
In essence: All commands are routed through ozm, which has a per project and global allow list and block list.
Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.