Autark AI Agents for Windows 10 and 11: No Guardrails, Full User Access

What Autark does​

Autark swaps the usual chat box for something closer to an office. Users drop tasks into a shared inbox. A manager agent routes or splits each task and hands the pieces to specialist agents. Those agents do the work and report back. The Register says agents can also ask clarifying questions when a task is too vague.

The pitch is that agents don't wait to be prompted. Autark's website says a schedule, timer, new task, message or event can wake them. They then decide what to do and can plan their own next step. The app keeps running in the system tray, so agents can keep working with the window closed. This only holds while the PC is on and the app is running.

The developer's own site includes an overnight example, with a briefing at 7:30 a.m. Autark labels it an illustration, "not a measured run." Treat it as marketing, not a benchmark.

Who built it, and how mature it is​

Stanislaus Hees describes himself as the founder of Teydra Lab and a software engineer in Salzburg. The Register reports that he is 14 and still in school. It also says he built Autark by prompting AI coding tools, not by hand-writing it. The pages I could inspect confirm his identity and Austrian base. They don't independently confirm his age.

Hees told The Register the idea came from frustration with tools like Claude Code and Codex. They helped with individual tasks, but he still had to organize the work and keep it moving. Autark was formerly called Proactive Agent Workforce and is described as a free desktop app for digital employees, tasks, chats, teams and personal day planning, with its own agent runtime.

The software is early:

• Public builds are labeled prereleases. The project page, dated October 27, 2026, says long-term operation and practical workflows are still being evaluated.
• The product site shows version 0.3.5 at the top. Its Windows download link names v0.3.4, a 132 MB installer released November 9, 2026. That mismatch is unexplained, so don't assume which build is current on each platform.
• The builds are unsigned. Windows SmartScreen will ask you to confirm the install through "More info" and then "Run anyway."

Platforms and AI engines​

Autark lists these supported platforms:

• Windows 10/11 x64
• macOS (Apple silicon and Intel)
• Linux x64
• Android 8 or newer
• An iPhone web app that needs iOS 17 or newer

Computer control varies by platform. On Windows, agents prefer UI automation over raw clicks. On Linux, input works on X11 only. On macOS, agents get screenshots but cannot control the machine.

The app is free with no Autark account. You still need an AI source: a ChatGPT plan through OpenAI Codex, a paid Claude plan through Claude Code, an API key or a local model. The Claude Free plan can't run agents.

Gemini CLI, GitHub Copilot CLI and Kimi Code are built in. Autark says it has never seen them in a live run. API keys and local models also have no recorded live run yet. Realistically, only Codex and Claude Code are proven paths.

Email support uses IMAP/SMTP with an app password. Outlook and Microsoft 365 are not supported yet, so don't expect it to plug into a Microsoft 365 environment.

The security model: no walls​

Autark is unusually blunt about this. Its site says agents run with the user's rights, with no sandbox, no approval prompts and no in-app guardian. They can read and change files, run commands, use the browser and use every secret in the catalog. The FAQ confirms there is no money limit and no approval gate. An agent could pay with anything it can reach, such as a saved card or a logged-in shop.

When setup starts, the manager asks how far it may go on the PC. Autark says plainly that this is a question and not a technical barrier. Purchase rules are editable guidance, not a lock. An agent holding a task that conflicts with your stated limits may still try to carry it out.

The Register quotes Autark's access page on its own test runs. It says agents given a vague request reached real repositories, backups, SSH keys and .env files within minutes, and one changed a file's permissions. I couldn't confirm those details on the current product page. Treat them as reported test observations, not independently verified findings. Hees also told The Register he wouldn't claim the app suits unattended access to sensitive systems.

What protections exist​

• Secrets by ID: Passwords and keys are encrypted with the operating system's protection. Agents refer to them by IDs like secret://github, and known values are masked in tool output. This reduces accidental leaks into prompts. It doesn't limit what an agent with catalog access can do.
• Kill switch: "Stop all agent work," or Ctrl+Alt+Shift+X, halts every agent on that PC. It stays stopped after a restart.
• Backups: The app copies its data folder on request and backs up its database before updates. Autark warns that these don't undo what agents did elsewhere.
• Local-first data: Chats, tasks, memory and the secrets catalog sit on your disk. Prompts go to whichever AI provider you connect, and that can include private files an agent opens. Autark says no Autark server holds user data and the app has no analytics. Its meeting server only relays end-to-end encrypted traffic between your devices. These are the vendor's claims, not an audit.

Practical guidance for Windows users​

Autark's own advice is to give the app its own Windows user or a virtual machine if the PC holds anything you can't risk. That is sound least-privilege practice. The key point is that isolation has to be enforced by the OS, not requested in a chat message. A sensible setup:

1. Create a dedicated standard (non-admin) Windows account just for Autark.
2. Keep your real SSH keys, .env files, repo clones, browser sessions and password managers out of that profile.
3. Or run it in a VM, ideally with no mapped drives or shared clipboard.
4. Connect only throwaway or scoped credentials, with no saved payment cards.
5. Learn the stop shortcut before you assign the first task.
6. Review the run journal, since Autark says every step is recorded there.

Open-source claims​

The Register says Autark is fully open source on GitHub under an Apache license, with self-hosting for even the meeting server. I couldn't verify that. The project page says public releases carry prerelease builds and installation notes. It also says the source of the internal runtime is not a public repository. Treat the licensing and self-hosting claims as unconfirmed until you check the repository yourself.

The bottom line​

Autark is a candid example of where agent tooling is heading: autonomous, proactive and as permissive as the user account allows. Its honesty about the lack of guardrails is more than many polished products offer. But a young developer's early prerelease, with unsigned builds, untested engine integrations and no technical limits, is a lab experiment. It isn't a production tool. If you try it, put it on a sacrificial machine, a VM or a locked-down account, and give it nothing you'd miss.