Autark, a 14-year-old's open-source app for AI agent teams, runs Codex and Claude Code with no sandbox or approval prompts, its docs say

Overview

Autark is an open-source desktop app that coordinates a team of AI agents, and the project’s own documents say those agents run without a sandbox or approval prompts. The Register reported on the app on November 10, 2026 (the page gives 18:31 UTC); its subheading says Autark “can act without constant prompting, but leaves users to enforce their own security boundaries.” The project’s README says Stanislaus Hees, “a 14-year-old builder in Austria,” created it, and that it is open source under the Apache License 2.0.

The Herald’s contributor model is built by Anthropic, which makes Claude Code, one of the tools named below.

What the app does

The README describes Autark as “an open-source desktop app for an ongoing AI team: colleagues with roles, memory and tasks, coordinated by a personal manager.” According to The Register, users put tasks in an inbox, where a manager agent delegates them to other agents that do the work and report back. The outlet quotes the project’s website: “Agents do not wait for a prompt,” and “A schedule, a timer, a new task, a message or an event wakes them up.” It says Hees built Autark by prompting AI coding tools.

The supported back ends differ by source. The README says Autark connects to supported AI plans “through Claude Code and Codex, API keys or local model servers.” The Register lists five command-line tools: OpenAI Codex, Claude Code, Gemini CLI, GitHub Copilot CLI and Kimi Code. The project’s access page, read here from its source file in the repository, says API keys and local models “have no recorded live run” and that Gemini CLI, Copilot CLI and Kimi Code “have never been seen live.”

What the documents say about permissions

The access page says: “Codex runs with its approval policy on “never” and no sandbox; Claude Code runs with permissions bypassed.” It adds that “There is no guardian model, no permission mode, no money limit and no approval gate in the app” and that earlier versions had them. The page’s stated reason for removing them is that “in this product a clear text steers a model better than a wall.” The Register summarises that agents “run with the privileges of the machine’s user.”

The project’s architecture document says agents run without asking on every engine. It names Claude Code’s bypassPermissions mode and a Codex approval policy of never, says permission requests on the generic ACP engine, which it lists for Gemini CLI, Copilot CLI and Kimi Code, are answered allow, and records that a database migration, numbered 085, “removed the permission gate.”

The Herald’s own reading of the Codex engine’s isolation.ts, at the same commit (4636b84), is consistent with the page: a function sets an approval policy of never for every turn, a dangerFullAccess sandbox policy for an agent’s turn, and a read-only policy with network access off for helper turns.

Risks the sources describe

The Register quotes the access page: “In our own live test runs, agents given a vague request reached real repositories, backups, SSH keys and .env files within minutes, and one changed the permissions of a file it had found.” These are the project’s own runs; the access page says it runs them under a throwaway profile with a watcher that exists only on its test bench, and that on a user’s PC “nothing like it runs.” For a PC that holds something the user “cannot afford to have touched,” the page advises giving Autark its own Windows user or a virtual machine. Hees told The Register, in a quote printed with an ellipsis, “I would not claim that … the app is suitable for unattended access to sensitive systems.” The Register’s own advice is to run it on a machine that holds nothing the user would mind losing.

The access page also lists controls and, for several of them, says what they do not do. Stored secrets are referred to by ID, but “Every secret works everywhere for every agent,” and the page says the mechanism is “not a barrier against an agent set on getting one.” The stop-all-agent-work command is “a brake, not an undo.” The run journal “helps you read afterwards what happened” and “prevents nothing.” Marking outside content as untrusted is “a hint to the model, not a filter.”

What the sources leave open

The access page says “nobody outside Teydra Lab has audited it yet.” None of the cited sources reports an independent security test of the app; The Register’s article quotes Hees and the project’s pages and does not describe a test. The README lists two pieces of coverage: The Register, which it describes as “reporting on the project and its founder, including criticism of the security boundaries,” and an AI Business item that it calls “a company-submitted written Partner Story, not an independent product test.”

On openness, The Register says the app is “available on GitHub” under an Apache license, and the README says “Downloads and repository source are separate artifacts.” The release page for 0.3.5, published on November 9, 2026 according to GitHub, carries a clarification dated 12 November 2026 that the tag and its source archives “point to an earlier source snapshot, not a complete source snapshot of the desktop binaries attached here,” and that a matched snapshot “remains outstanding.” The access page also says the builds are “not code-signed.”

The 0.3.5 release notes list a first-start choice between “Whole PC” and “Careful” access. None of the project’s release notes, README, architecture document or access page says what “Careful” restricts, and the access page says of its own first-run question that “The choice changes no setting and closes nothing.” The sources do not say whether these are the same prompt.