A 14-year-old Austrian developer has built an AI team that can work without repeated instructions, but its agents can also access private files on users' computers.
Stanislaus Hees created Autark, an open-source platform that coordinates AI agents and resumes tasks independently.
According to The Register's 10 November 2026 report, Autark has no built-in sandbox or approval gates. Its agents operate with the permissions of the user running the software, leaving users responsible for restricting access.
How the AI Team Works
Autark functions like a virtual company. Users submit assignments to an inbox, where a manager agent delegates tasks to specialists and tracks their progress.
Agents can ask questions, report results and continue working without further prompts. Schedules, timers, messages and other events can restart activity while the computer remains on.
Hees told The Register that existing AI assistants helped with individual assignments but left him managing unfinished work. He used AI coding tools to develop a system designed to handle those follow-ups.
Autark works with OpenAI Codex and Claude Code. Support for several other services and local models is built in, although some integrations have not been tested in live runs.
Why Autark Can Access Private Files
Autark's access documentation says agents can read, modify and delete files available to the computer's user account. They can also run commands, install software and use connected services to send messages or spend money.
The project does not enforce spending limits or require approval before these actions. It asks users how much freedom agents should have, but their answers provide instructions rather than technical restrictions.
'That is a question, not a technical barrier,' the documentation states.
These permissions apply to the computer running Autark and any linked computers or services the agents can reach. They do not provide automatic access to unrelated devices.
Internal Tests Reveal Sensitive File Access
Autark's developers say agents reached repositories, backups, SSH keys and environment files within minutes during internal tests. One agent reportedly changed a file's permissions.
These are developer-reported observations, not evidence of a confirmed breach affecting users. The project also says its security arrangements have not undergone an independent audit.
Autark says stored passwords and keys are encrypted and referred to by identifiers rather than exposed directly in prompts. However, agents may still use those credentials through connected tools.
The company says its servers do not store users' data. Its documentation nevertheless warns that information processed by agents, including private files they read, can be transmitted to external AI providers.
Creator Cautions Against Unattended Use
Hees told The Register he would not claim Autark was suitable for unattended access to sensitive systems. The project's documentation recommends a separate user account or virtual machine where important files need protection.
On 1 May 2026, cybersecurity agencies from the UK, US and other allied countries issued guidance urging restricted agent permissions, monitoring and human oversight.
Autark's source code, including its connection server, is available on GitHub for self-hosting. Anyone testing it should isolate the software, limit access to credentials and monitor what its agents do.
The reported danger is not a verified widespread compromise. It is the possibility that autonomous agents could alter or expose sensitive information before a user intervenes.
Frequently Asked Questions
- What is Autark?Autark is an open-source platform that coordinates AI agents to work independently on tasks.
- What are the security concerns with Autark?Autark agents can access private files and perform actions without built-in sandbox or approval gates, posing potential security risks.
- How does Autark handle permissions?Autark operates with the permissions of the user running the software, and users are responsible for restricting access.
- What precautions are recommended when using Autark?It is recommended to use a separate user account or virtual machine and to monitor agent activities closely.
