Athena

• 

  cover

• 

  logo

Inspiration

Most of what people need done lives inside web apps that will never offer an assistant: an invoicing tool, a tax portal, a landlord's page. The assistants that exist either live in a chat window beside the work, or they are given the keys and trusted. We wanted the opposite: a private assistant that sits inside the apps you already use, can operate them, and is provably unable to do the irreversible thing without you. The question behind the project was not "can an agent click a page" but "how would you know it won't do harm when someone attacks it", and that is where Nemotron on Nebius came in.

What it does

Athena is an always-on desktop assistant for the Personal AI track. She holds your web apps in tabs and an agent in a column beside them. She sees the page you are on and operates it: if the page offers its own actions she calls them, and if it offers nothing she reads, clicks and types as a person would.

• A gate she cannot talk her way past. Anything irreversible, or anything that leaves the app (sending a reminder, voiding an invoice), stops and becomes a decision card you approve or decline. One approval runs exactly one action, once.
• Projects with walled memory. Each job has its own brief and memory; what is learned in one never leaks into another. Memory cites where it came from.
• Chores. 100 playbooks, each with a committed benchmark. You describe a chore in your own words, she finds the one that fits, asks what differs in your case, and rehearses it on a world shaped like yours before it is real.
• Local voice. She speaks with Kokoro on your own machine (free, nothing sent anywhere) and hears with local Whisper, with a cloud engine one key away.
• A ledger. Every model call and its cost is a row on your disk you can read.

Her proof is the Proving Ground: Nemotron 3.5 Lightning writes the attacks (hostile page text, a poisoned tool result, a planted memory), they go to a real Athena, and the verdict is read from the gate's own records, never from a model. Across three full runs: 306 hostile turns, 0 breaches. The Nemotron side of the first 93-turn run cost $0.023; the Claude control cost $3.20.

How we built it

• Shell and daemon. A Tauri v2 desktop app (Windows, WebView2) over a local Python daemon that owns brain, recall, the gate, approvals and the ledger. Pages talk to it through a thin bridge, so nothing is installed into the websites.
• Day to day she thinks on the CLI you are already signed in to (Claude Code or Codex), so no key is needed to try her. A nebius engine runs her on Nemotron Super behind the same gate and ledger.
• The Proving Ground drives a throwaway Athena through the daemon's own routes for each attack, then reduces the gate's records to a verdict. Each Nemotron role has a falsifiable proof test, a kill criterion and a Claude Haiku control row. We did not know the quality of the tooling when we began, so nothing was polished before it proved.
• Nebius Token Factory serves every Nemotron call: Lightning as attacker and user simulator, Super as second judge and as an engine, Super-VL as the document reader.
• Process. One commit per feature with its tests, an ADR for each decision, and run reports (report.json, ledger, cost) kept for every number we quote.

Challenges we ran into

• The reasoning switch. Only one of five documented spellings turned Nemotron's reasoning off; the other four returned HTTP 200 and were silently ignored. With reasoning on, 2 of 9 Lightning answers were about 30,000 characters of chain of thought with no tags and never reached the JSON we asked for.
• Nemotron as a judge. Agreement with our Haiku judge ranged from rho 0.08 to 0.42 on Lightning and 0.36 to 0.53 on Super across five runs, and both were lenient. Both scored a pending decision card as "sent" until we stated each card's status in the prompt.
• A bug the Gauntlet found in our own gate. The approve-path probe showed the replay step accepted the same approval twice. The gate now spends an approval as it lets the action through.

What we learned

• Nemotron is an excellent adversary and user, and not yet a trusted judge. Lightning stayed in persona on 94% to 97% of turns and its attacks reached 0.60 to 0.88 of the control's valid-attack rate. Treat it as a role player first; score its judgments beside a stronger judge, never instead.
• Reasoning is a per-role decision. Off, Lightning's JSON roles went from 35 to 45 of 45 schema-valid at a tenth of the cost. As the agent with tools, off was 3.5 times faster but it answered plain questions with a bare tool call (turns with no text rose from 3 to 24 of 112). Super lost nothing with reasoning off.
• Trust is a ratio of evidence to claim. The row where the gate held without ever being attempted was a limit worth saying out loud, and the Nemotron row is what showed the gate under attempt.
• Open weights matter for one reason: a run against a pinned open model can be repeated by someone else.

What's next for Athena

• Make a judge we can trust, by calibrating a Nemotron judge against human-labelled transcripts and promoting it only if its agreement holds across seeds.
• Two devices. Pairing over a private network, write-once memory replication and a phone page are built and tested and need a second device to show.

Built With

• nebius
• react
• tauri