It can do everything. Here is what that means.

In short

Agents have full access to your PC

Agents run as you. Codex runs with its approval policy on “never” and no sandbox; Claude Code runs with permissions bypassed. So an agent can:

• read, change and delete any file your user account can, private ones included;
• run any command and install programs;
• use a browser, and on Windows or Linux with X11 your mouse and keyboard;
• use every secret in the catalog on any site, including a saved card, so it can spend money;
• send mail and messages through what you connected, and publish;
• do the same on a PC you linked.

There is no guardian model, no permission mode, no money limit and no approval gate in the app. Earlier versions had them. They were removed on purpose: in this product a clear text steers a model better than a wall, and a wall mostly produced questions. The provider’s own model rules still apply.

The first question

The first run is short: a short tour, connect one AI, type your name and company, press Start. Then the app posts one automatic line in your manager’s chat, as if you had written it and marked as the app’s start text. It tells the manager to get to know you and your work, on the web and on this PC, and to ask you first, with a choice, what it may do: full access to this PC for good, this one search including private files just this once, or less.

The same line tells it to say plainly that it technically can already. The choice changes no setting and closes nothing. Your answer tells the AI what you want, an answer “for good” belongs in its memory, and a model follows it because you said so. You can read and replace this text: an own prompts/onboarding.md in the data folder takes its place.

What steers them instead

Agents act on what they read, so that is where the care goes. All of it is plain text you can open and change.

• The rules every agent gets (rules.md), for example: before something you cannot undo, such as deleting, paying or sending to outsiders, check target, amount and recipient once.
• Each agent’s instructions (SYSTEM.md), which you or the manager can edit.
• Skills. The ones that matter most have their description in every prompt, so a model reads them before that kind of work.
• Spending is a skill too. It gives reference points to think with: roughly under 20 euros, buy when it is recognisably sensible; above that, it helps when the one above you was clear what is bought and why; for hundreds of euros, have a stronger model think it over once more. You can rewrite it. It is guidance. No code stops a purchase.
• Your own words. A message at any time steers running work, and one marked important reaches it at once.

Text can be wrong, and so can a model. A web page, a mail or a file can also contain instructions aimed at your agent. The app marks such content as untrusted when it hands it over, and that is a hint to the model, not a filter. Treat what an agent reads from outside as something that can influence it.

Secrets are referred to by ID

Passwords and keys live in a catalog, encrypted with your operating system’s protection: the Windows user key, the macOS keychain, the Linux keyring. If that protection is not available, the app stores nothing rather than falling back to plain text.

• By ID. Agents see each secret’s name, description and ID, such as secret://github. The catalog’s text lies open in secrets/ in the data folder, without a single value.
• Values stay out of prompts. The value is filled in at the last moment: into a browser field, a command’s environment, a request header or a connector.
• A field for it. The + in the message box has a Secret entry, so you hand over a key without typing it into a chat. Text you type into a normal message does reach the model.
• Masking. Before a tool runs, a known value in its arguments is replaced by its ID, so it does not land in a note or file. In output, known values are masked, also as base64, URL-encoded or hex. Values under 8 characters are too short for this.
• No site binding. Every secret works everywhere for every agent. That is deliberate.

What this does not do: a command that receives a value can do anything with it, and masking only knows those encodings. It keeps values out of prompts and logs; it is not a barrier against an agent set on getting one. And it covers only the catalog. A password in a text file, a .env file or a browser export on your disk is as open to agents as any other file. Password import reads such an export once and leaves the file where it is. Please delete it.

Your AI sign-ins

You sign in to ChatGPT and Claude through the providers’ official tools, Codex and Claude Code, each added account in its own folder under accounts/. Autark does not read, copy or forward the tokens those tools keep, and there is nothing to sign in to on our side. An agent with full access could still open those folders like any other, so this describes what the app does, not what an agent can reach.

Where your data lives

Data folder

Windows %APPDATA%\Autark, macOS ~/Library/Application Support/Autark, Linux ~/.config/Autark. Settings › About opens it, and its README.md lists every entry and what editing it does.

Database

workforce.db: chats, tasks, runs and accounts, with secret values encrypted. Stored files are in blobs/.

Plain files

settings.json, agents/, memory/, secrets/ (no values), connectors/, prompts/, theme.css, and a readable copy of your chats in chats/. What you and your agents change here, the app takes over.

Workspace

~/Workforce: projects, downloads and shared skills.

Uninstalling

Removes the app, not this data. Delete the folders yourself if you want it gone.

What leaves your PC

There are no Autark servers, and the app has no analytics or usage reporting. Things do leave your PC, though, and these are the places:

Your AI provider

Everything an agent works with: your messages, its instructions, what it read, including private files if it opened them. That provider’s terms apply. With a local model it stays on your hardware.

Model downloads

The small local search model (118 MB plus a 17 MB tokenizer, from huggingface.co) is fetched without asking the first time it is needed. Speech models come from huggingface.co or github.com when you pick them.

Embeddings

If you choose an API provider for embeddings, pieces of text go there. Known secret values are replaced first.

Web search

Codex and Claude Code use their own search. Otherwise search goes to DuckDuckGo or Bing, or to Brave, Tavily or your SearXNG if you store a key for one.

Other services

What agents open or connect sees the request, as if you did it: websites, connected apps, your mail server, Google Calendar, Telegram. When a mailbox is added, its domain may be looked up in Mozilla’s public mail directory and at the domain itself.

Updates

The app asks GitHub for new versions. If you have it install Codex or Claude Code, it runs that provider’s official installer.

Phone notifications

Small encrypted notifications through your phone browser’s push service, if you use them.

Feedback

Reports, also those agents write, are saved on your PC. Nothing goes out unless you press send, and then it is encrypted on your PC so that only the Teydra team can read it. The app says whether this version can send at all.

For Teydra Lab as a company, see the privacy policy and the imprint.

Backups and export

• Back up in Settings › About copies the data folder, into backups/, or a folder you choose. It leaves out provider logins. Secret values stay in it encrypted with this PC’s key, so they open only here. Agents’ browser profiles with their logged-in sites and the scripts in connectors/ are copied as they are, so treat a backup as private. It only runs when you or an agent start it, and the default place is on the same disk, so copy it elsewhere.
• Restore happens at the next start and keeps what it replaced in before-restore-<time>/. On another PC you sign in again and enter your secrets again.
• Before an update the app copies the database by itself to backups/pre-upgrade/. If starts keep failing, a repair screen opens.
• Export in a chat’s menu writes it with its messages and files into exports/. All chats at once, into a folder you choose, is in Settings › About. chats/ in the data folder holds a readable copy anyway.
• Memory is plain Markdown, so it copies and versions like any folder. An agent’s forget or deleting the file removes a memory; older copies in backups keep what they held.

None of this undoes what an agent did outside the data folder. A deleted project or a sent mail does not come back through a restore.

Stopping work

Stop all agent work is in the tray, in the list behind the chat header’s live line and in the command palette. While agents work, Ctrl Alt Shift X does the same.

• Every running turn on this PC is cut and no new one starts; tasks pause. It holds across a restart until you choose Resume.
• Work running on another linked PC goes on. Stop it there.
• A script an agent left running on its own, such as a WhatsApp bridge, can keep running. End it yourself.
• It is a brake, not an undo. What is done stays done.

There is no Stop button in the chat itself: a message redirects an agent. Closing the window does not stop anything, because agents keep running in the tray. With “Start with Windows” or “Start at login” on in Settings, which is off by default, the app also comes back at sign-in and after a crash, and on Windows for the next due work after you quit.

What is written down

Tool calls and their outcome are written to a run journal. Under an agent’s message you can open its steps, and its page in Team lists its runs. After a crash, a call that may have had an effect is reported to the agent as unknown to check, rather than simply repeated. This helps you read afterwards what happened. It prevents nothing.

Who else can reach it

• Programs on this PC. The running app answers on a local port, with a token in runtime.json. Any program running under your user can read that file and control the app. This is how scripts and bridges work.
• Your phone: phone access is off until you turn it on, and reaches only this PC by default. You choose the local network or your tailnet. A phone joins by QR code as CEO, who sees everything, or as an employee, with their own chats and tasks. Turning access off locks every phone out until you turn it on again; only removing a phone in Settings › Devices ends it for good.
• Colleagues join by your invite link and connect to your PC. They see the chats and tasks they belong to.
• Other PCs: another PC can ask to connect, and you accept each one after comparing a code. A linked PC’s agent can then run tools here like one of your own. An optional meeting server helps PCs find each other. None is set by default, and we run none.

Unsigned builds, and what you will see

Autark is not code-signed: no Windows certificate, no Apple Developer ID. Your system cannot confirm who made the file, so it warns you. What follows is what you will see. All steps are also on the download page.

Windows

1. Download autark-windows-x64.exe. Your browser may warn that the file is not commonly downloaded; choose to keep it.
2. Start it. Windows shows a blue box, “Windows protected your PC”, with only a Don’t run button. Choose More info, then Run anyway.
3. Install. Keep “only for me”: no admin rights are needed. Pick a folder or keep the suggested one. A desktop shortcut is created.

If Run anyway is not offered: with Smart App Control turned on, Windows can block an unsigned installer outright, and there is no button to get past it. Turning Smart App Control off is a change to your whole PC and your decision. Read Microsoft’s note on it first, or use another PC.

macOS

1. Download the DMG and open it. Drag the app into Applications.
2. Open it. macOS refuses the first time and says Apple could not check it for malware. Close that box with Done, not Move to Trash.
3. macOS 15 and newer: open System Settings → Privacy & Security, scroll down to Security, choose Open Anyway next to the app’s name and confirm with your password or Touch ID. macOS 14 and older: Control-click the app in Applications, choose Open, then Open again.
4. If macOS says the app “is damaged”, or still will not open it, the cause is the quarantine mark macOS puts on downloaded files. Check the file first (below), then remove the mark in Terminal:
   xattr -dr com.apple.quarantine "/Applications/Autark.app" Copy

That command tells macOS to stop treating this one app as an unchecked download. Nothing is repaired by it and nothing else on your Mac changes. Autark has no Apple Developer ID yet: the app is signed ad hoc and not notarized, so macOS offers no way around these steps. macOS may ask again for access to your keychain after an update, because every build carries its own ad hoc signature.

Linux

1. Download autark-linux-x64.AppImage and make it executable: chmod +x autark-linux-x64.AppImage.
2. Run it. It needs FUSE 2, a working Chromium sandbox and a running system keyring. Without a keyring, secrets cannot be stored; there is no plain-text fallback.

Checking a file

Every release lists SHA-256 hashes in SHA256SUMS.txt. On Windows: Get-FileHash .\autark-windows-x64.exe in PowerShell. On macOS or Linux: shasum -a 256 <file>. A match shows the file arrived as published. It does not replace a signature, because the list comes from the same release as the file.

Updates

While the window is open the app asks GitHub Releases every minute, and every 15 minutes from the tray. A small icon appears only when an update exists. On Windows and Linux one click downloads it, checks it against the SHA-512 in the release manifest, installs it and restarts.

On macOS the app replaces itself where macOS allows it. That path is new; if macOS refuses, the app keeps working and the icon leads to the download.

What is not proven yet

Autark is young. This is what we have not proven.

• Releases. Version 0.3.2 passed packaged start-up checks on Windows, Linux, Apple silicon and Intel. The update from 0.3.1 was not run on a PC before release; linked PCs need the same version to share settings and plan logins. A fresh Windows install, the update on macOS and Linux, and the AppImage on an ordinary Linux PC were not established.
• The first question: whether a model really asks first, in your language, has not been checked with a live model. It is a text, so a model can phrase it differently or skip it.
• Doing things on its own. Agents wake up and carry on, but how much they do on a vague request still varies by model and by run. In our own rounds they sometimes asked instead of finding out. The decision model behind the subconscious has also answered without having searched.
• Browser per chat: tested in real windows with a scripted test engine, not with a real model, and not on macOS.
• Providers through a file: tested with fakes, not against a real provider. API keys and local models have no recorded live run; Gemini CLI, Copilot CLI and Kimi Code have never been seen live.
• Devices and accounts. Google Calendar has not been tested against a real Google account, email not against a real mailbox, voice not with a real microphone or phone, phone access and linked PCs not on physical devices.
• macOS. Agents cannot control the computer there; they get screenshots. The install steps above are written from what macOS shows for unsigned apps, and have not been re-checked on every version.
• Source code. It is not public, so you cannot audit it yourself today. The installers are public on GitHub.

Reporting a problem

For a bug that puts no one at risk, open an issue on GitHub. For anything sensitive, such as a secret that leaks or a problem with updates, please do not post it publicly. Contact Teydra Lab directly and give us time to fix it.