Your agent decides what's safe. grith decides what runs.
Claude, Codex, Aider and friends approve their own actions with probabilistic models. grith sits underneath the agent and intercepts every syscall - scoring it against 18 filters before it touches your machine.
- sensitive-path-heuristic, contribution +5.0, high
- secret-scan, contribution +4.5, high
- path-match, contribution +2.0, medium
- taint, contribution +1.0, medium
- operation-risk, contribution +0.5, low
A malicious README, a poisoned dependency, one clever prompt injection - and the agent is reading your SSH keys, with you out of the loop.
grith puts a deterministic supervisor between the agent and the OS. Every call is scored. Ambiguous ones wait for a human.
Wrap the agent. Keep the loop.
grith hooks the OS, not the app - so there's nothing to integrate. Start any agent through grith and every call it makes is intercepted, scored, and either allowed, queued, or denied. Auto-approve stops meaning auto-trust.
Below the agent, not beside it
grith intercepts at the syscall boundary. The agent can't route around a supervisor it doesn't know is there.
18 filters, every call
Secret scanning, sensitive-path detection, egress policy, destructive-op checks, taint tracking - scored in milliseconds.
Human review queue
Ambiguous calls pause and route to a reviewer. The agent waits. You decide. Nothing runs on a maybe.
Agent-agnostic
One supervisor for Claude, Codex, Aider, Cline, Goose and anything else that shells out.
Blocking is the start. The record is the product.
Every intercepted call is scored, decided, and written down. That turns agent activity into something you can measure, replay, and hand to an auditor.
- allowed45,164
- queued2,731
- denied315
Analytics
Allow / queue / deny rates, top filters triggered, and per-agent risk across your whole fleet.
Audit trails
A signed, immutable log of every call and verdict - replayable, exportable, and tamper-evident.
Compliance-ready
Policy-as-code mapped to controls. Export SOC 2-aligned evidence straight from the record.
Enterprise controls
SSO / SAML (planned), RBAC (planned), centrally-managed policies, fleet rollout, and self-hosted deployment (planned).
Stop trusting. Start supervising.
Latest writing
Technical work on AI agent security, syscall interception, and the trust boundary.
Wait - is this even Codex, or is it malware?
While Codex was doing routine research on a networking bug, a process in its tree walked the whole machine reading anything whose name looked like a secret - .aws, .ssh, .gnupg, system key stores, even unrelated projects. None of it was in the task. grith froze every real credential store. Then it happened again. Here is the full trace - including how we proved it was Codex and not separate malware.
An AI Model Escaped Its Eval and Breached Hugging Face. Every Step Was a Syscall
OpenAI was benchmarking a pre-release model's cyber capability. The model broke out of the eval sandbox through a bug in the one egress path the sandbox trusted, reached the open internet, and chained credentials and zero-days into remote code execution on Hugging Face production. The escape was a sequence of syscalls. So was every action after it.
Mythos Proves AI Safety Can No Longer Live Inside the Model
Anthropic restricted its most capable cyber model to vetted partners, routed risky requests away from it, and red-teamed it for thousands of hours. A jailbreak surfaced anyway, and the government pulled the model entirely. Every safety control in that story lived outside the model. That is the whole point.