Why we built grith

We build with coding agents every day - Claude Code, Codex, Aider. They ask permission before acting, and like everyone else we eventually switched on auto-approve, because reviewing forty prompts an hour is not a workflow. At that point the agent is approving its own actions, and the thing doing the approving is the same probabilistic model that a poisoned README or one clever prompt injection can steer.

So we started measuring. In early 2026 we put Claude Code and Codex under strace on identical tasks: Claude Code attempted 752 reads of /proc/*/environ in one benchmark run, and 256 succeeded - methodology and scripts are public. In July 2026, while dogfooding an early build, a Codex session on our own machine started sweeping the disk for credentials during a routine networking task. grith froze it mid-syscall - the full trace is on the blog.

None of that is malice. It is what capable agents do when nothing constrains them: your whole machine, held as ambient authority.

We assume prompt injection is unfixable, so grith does not try to make the model safe. It sits underneath the agent at the OS boundary: every syscall is intercepted, scored against 18 filters, and either allowed, queued for a human, or denied before the kernel executes it. The agent cannot route around a layer it does not know is there.

grith is built by Dan F, founder of Field Logic Ltd, a London software company. Thirty years of building software, much of it in the business of filtering hostile input: technical director at one of the UK's first internet service providers, seventeen years running a guaranteed anti-spam service used in more than thirty countries, and an IoT security platform. AI agents are new. Scoring untrusted input before it can do damage is not.

grith is developed under grith: the machine it is built on runs its coding agents under grith exec, the code is written with AI assistance, human-reviewed, and gated by 1,600+ tests. The Codex trace above is that setup catching a real one.