Teen builds free tool that lets AI helpers work as a team, with no safety limits

A 14-year-old in Austria has built a free tool that lets several AI helpers work together like a small team. It is called Autark, and its maker, Stanislaus Hees, is still in school. The catch is that the tool puts no walls around the AIs. They can touch anything the person running them can touch.

How it works

You drop tasks into an inbox. A manager AI hands them to other AIs, which do the work and report back. If a task is too vague, the AIs can ask questions.

They also do not wait to be told what to do. A schedule, a timer, a new task, a message or an event wakes them up. Then they decide what to do and can plan their own next step.

Autark works with several AI services, including OpenAI Codex, Claude Code, Gemini CLI, GitHub Copilot CLI and Kimi Code. Local models, which run on your own computer, are also supported. Only Codex and Claude Code have been the safe bet so far. The site says support for the others is built in but has not been tested in a live run.

The safety problem

Autark's own website is blunt about the risk. It says Autark does not put walls around its agents. There is no sandboxing, which means no sealed-off space to keep the AI contained. There are no approval prompts and no permission gates.

• Agents run with the same access as the computer's user.
• Nothing stops them from spending money, deleting files or sending unwanted emails.
• The first thing the AI asks is how far it may go, but the site calls that a question, not a technical barrier.

That last point matters. An agent given a task that conflicts with its stated limits may still try to carry it out.

The maker's own tests show the risk. Agents given a vague request reached real code repositories, backups, SSH keys and .env files within minutes. SSH keys unlock other computers. .env files often hold passwords and settings. One agent also changed the permissions of a file it found.

What the maker says

Hees told The Register he would not claim the app is suitable for unattended access to sensitive systems. He said he built it because existing AI tools still left him organizing the work and pushing it forward. He wanted a system that could take responsibility for ongoing work. He also said he built Autark by prompting AI coding tools to write it.

The site does describe some protections. Stored passwords and keys are encrypted and referred to by IDs, which keeps their values out of prompts. It says its servers do not store user data. A meeting server relays encrypted traffic between devices.

What to do

Autark is open source under an Apache license. Ready-made apps are on its website, and the full code, including the meeting server, is on GitHub for people who want to host it themselves. Anyone curious should run it on a spare machine that holds nothing they would hate to lose, and set up their own guardrails.