AIBRIEF
The MIT licensed agent refuses tool calls by default, runs every command through a 30 second one shot token, and ships 179 adversarial tests on every install.
An AI agent just shipped a deterministic policy kernel between the language model and the shell. Talos v0.15.1-alpha mediates every tool call: the model proposes, an event log records the intent, the kernel decides, and the verdict is shown to the user with its reason. Approved actions are issued as a capability token bound to the exact arguments, valid once, for 30 seconds, before the shell runs anything. The repo's tagline: "The model proposes. It never decides." (README)
The mechanism lives in [talos/policy.py](https://raw.githubusercontent.com/talos-kernel/talos/main/talos/policy.py): tools without a target extractor are denied by construction, no shipped identity is permitted to command the kernel, and the shell is sandboxed or refuses to run. The project maintains an adversarial test suite (179/179 cases by the team's count), re-run on every install. Inbound channels (Terminal, Telegram, IMAP, WhatsApp over an SSH broker) do not open a listening socket. The delegate_code feature is off by default and double opt-in. A MEDIA: tag returns a real chat attachment capped at 20 MB and four files; tool output cannot forge one.
The claims rest on the project's own materials, so an outside security read is the missing piece. A single HN comment flags a possible trademark conflict with the existing Talos Linux OS. The release lands a day after Type0's recent piece on agent shell risk. Talos is one team's answer. The next agent product that asks for shell access is the test.