Talos ships a deterministic permission kernel around Claude, with 2,242 tests as the proof.

Every tool call passes a path floor, immutable hardline rules, a sandbox and operator approval, and each granted effect binds to its exact arguments, valid once, for thirty seconds (Talos). It declares 23 tools split into 15 free read tools, 5 write tools where reversible changes run automatically and irreversible ones need approval, and 3 exec tools that run sandboxed or are refused. The installer runs 2,063 unit tests and 179 adversarial cases on setup. The makers state plainly that it defends against mistakes, not a malicious model, which is more honest scoping than most agent security marketing.