Sovereign-OS

Inspiration

Personal AI agents are starting to improve themselves. Agents like Hermes turn completed tasks into reusable skills, so the agent gets more capable over time. But that also creates a new attack surface: one poisoned file, web page or email can steer an agent into "learning" a skill that leaks data, and once saved, that skill runs again every time.

Sandboxes stop dangerous actions at runtime. I wanted to answer an earlier question: should this skill be allowed to exist at all?

What it does

SovereignOS is a vetting pipeline for agent-generated skills. Before a skill is accepted, it goes through three stages:

1. Static scan. Parses the Python skill with the AST, without running it, and infers what it needs: network access, shell access, secrets, or dynamic code execution.
2. Manifest diff. Compares those permissions with what the task justifies. A CSV-analysis task needs no network and no secrets, so a skill that asks for them is rejected.
3. Nemotron review. NVIDIA Nemotron on Nebius Token Factory explains the risk in plain language for the user.

The key design rule: the model explains, but it never decides. The verdict comes from deterministic checks, so a prompt injection can't talk the system into approving a skill.

In the demo, a clean csv_analyzer skill is approved. A poisoned report_helper skill, which reads ~/.ssh/id_rsa and sends it to a remote server, is rejected for network and secrets, and Nemotron explains exactly why.

How I built it

• Python ast for static analysis: imports, function calls and string constants reveal network, shell, secret and dynamic-code use.
• YAML task policies define what each task type is allowed.
• NVIDIA Nemotron via Nebius Token Factory, called through the OpenAI-compatible API, for the plain-language risk review.
• A showcase website (HTML/CSS/JS, GitHub Pages) with an animated pipeline and an interactive replay of the real run.

Challenges I ran into

• Getting the environment and API configuration right: loading credentials from a .env file without ever committing the key.
• Finding the correct Nemotron model ID on Token Factory.
• Reasoning models can return their output in a separate field from content, so the client needed a fallback.
• Keeping the boundary clear: deciding where the model should help (explaining) and where it must not be trusted (deciding).

Accomplishments that I'm proud of

• An end-to-end pipeline that catches a credential-stealing skill before it ever runs.
• A clean separation between deterministic security decisions and model-generated explanations.
• A Nemotron explanation that correctly identified the SSH key read and the exfiltration endpoint.

What I learned

• Self-improving agents need governance at the point of learning, not only at the point of execution.
• LLMs are valuable for explaining security findings to people, but security decisions should stay deterministic.

Known limitations

Static analysis can be evaded, for example through obfuscation such as building module names from strings with getattr and __import__. That's why the roadmap adds a sandboxed test run as a second layer. This prototype also vets hand-written example skills rather than skills generated live by an agent.

What's next for SovereignOS

• Hermes Agent integration: vet every skill Hermes learns before it loads.
• OpenShell / NemoClaw sandbox test run as a second check that catches what static analysis misses.
• Autonomy Governor: deterministic LOW / MEDIUM / HIGH / CRITICAL policy for every agent action.
• Memory provenance guard: quarantine memories that come from untrusted files or web pages.
• Attack benchmark: about 25 attacks run on Nebius Serverless Jobs, reporting which layer caught each.

The AI can evolve. The user keeps the authority.

Built With

• factory
• hermes
• nebius
• nemotron
• token