14-year-old creates tool for AI agents to band together like a team

Autark can act without constant prompting, but leaves users to enforce their own security boundaries

Built by a 14-year-old developer, a new tool called Autark treats AI agents as a virtual team that can work without constant prompting.

Users put tasks in an inbox, where a manager agent delegates them to other agents that carry out the work and report their results. Agents can also ask clarifying questions if tasks are too vague.

“Agents do not wait for a prompt,” Autark’s website explains. “A schedule, a timer, a new task, a message or an event wakes them up. They decide what to do, do it, and can plan their own next step.” 

REG AD

As one would hope from a product like this, Autark is model agnostic and can be set up to connect to OpenAI Codex, Claude Code, Gemini CLI, GitHub Copilot CLI, and Kimi Code through those services’ CLI tools. Local models are also supported. Your mileage may vary if you choose to use anything besides Codex or Claude Code, though, as Autark’s website mentions support for other models is built in but hasn’t been tested in a live run yet, as Autark is still under active development as an open-source tool. 

REG AD

Real teenage engineering

Autark is the brainchild of teenage Austrian developer Stanislaus Hees. He’s still in school, and tells The Register he’s deeply interested in AI and came up with Autark after being unhappy with existing AI tools. 

“I could get help with individual tasks, but I still had to organise the work, remember what was unfinished and keep pushing it forward,” Hees said of his time using Claude Code and Codex. “I wanted a system that could take responsibility for ongoing work, not just respond to my next message.”

He developed Autark - or, more accurately, prompted AI coding tools to do it for him - to come up with a tool that could fulfill that want. You know what that means: It’s capable, but that capability also makes it dangerous. 

Autark’s page on access and data makes clear what’s at risk if you give it unfettered access to a PC, and why you don’t want to let the thing run roughshod over a system.

“It can do everything,” the page explains, because “Autark does not put walls around its agents.”

There’s no sandboxing in Autark, no approval prompts, and no permission gates. It doesn’t stop agents from spending all the money they can get their hands on, deleting files, or sending unsolicited emails, either. Agents run with the privileges of the machine's user, with approval checks and permission restrictions disabled or bypassed. Even the safety limit parley that users have with Autark establishes guidelines, not rules. 

“The first thing the AI asks is how far it may go,” the access page points out. “That is a question, not a technical barrier.”

REG AD

That means agents given a task that conflicts with their stated limits may still attempt to carry it out. As we’ve seen in recent months, some AI agents have found ways around restrictions, instructions be damned.

“In our own live test runs, agents given a vague request reached real repositories, backups, SSH keys and .env files within minutes, and one changed the permissions of a file it had found,” the access page notes. 

In other words, it’s probably best to stick Autark on a machine that doesn’t contain anything you’d want to avoid losing - even Hees admits as much. 

“I would not claim that … the app is suitable for unattended access to sensitive systems,” the teen dev told us. 

That’s not to say Autark lacks protections for secrets, though. Autark’s site explains that stored passwords and keys are encrypted and referred to using IDs that keep their values out of prompts. It also says its servers don't store user data, with a meeting server used to relay encrypted traffic between devices.

If you're willing to try Autark to see whether it can improve your workflows, you don't need to rely on its servers. While prepackaged apps are available from Autark’s website, it’s also fully open source and available on GitHub. Everything, even the meeting server code, is available for self-hosting and modification under an Apache open source license. 

The bottom line is that this is a tool built by an ambitious young person, and it’s a tool with a lot of potential if used correctly. That correct usage is the major challenge, though, so be sure to build your own guardrails.  ®