lovely.
It operates under least priv. And the user must approve the Launch Agent (runs under use space, same as running locally within the App), and the Launch Daemon. There are 4 levels involved and the Daemon is last on the list and is rarely used. The user can just disable it and its tools get disabled as well. The LLM won't be able to use it in that state.
What gets used: 1. AppleScript/Osascript TCC, runs within the app, user approve each app being automated 2. AgentScript/Swift Dylibs/ScriptingBridge, same TCC runs within the app 3. Local shell scripting - backup if the user's Launch Agent (user space is down 4. Launch Agent (runs in the user space), primary for running shell commands. 5. Launch Daemon, software updates, etc. Anything the previous 4 layers can't handle. Rarely ever used. can be turned off by the user. I have used it to access the security of the Mac itself and it was surprisingly accurate and thorough.
If had a concern they had months ahead of time reserve
I'm also the creator of BigMac, that supported unsupported macOS installs on old Mac Pro 2008-2012 hardware. Neither Apple nor McD's chimed in.
Been using Macs since 1984. Mac OS X since 2000, beta 1.
I really didn't think about humanizing the name. I just felt this flowed really well https://agent.macOS26.app and https://github.com/macOS26/agent
I do want to thank those who have taken the time to look at the app and who have left feedback!
What’s the current model for distinguishing user intent from “content the agent read”? Is it purely the system prompt guidance, or is there something structural?
Thanks for posting.
I've locked down Agent! from one of its processes and run it in a VM and it tried everything it could to break out. It couldn't but it was fun watching it trying to resign compiled Dylibs, the Launch Agents / Daemons and itself. Because of SMAppService, it lost connection with its background process and once it basically hosed itself, I ended the experiment.
Anything priv. runs through the Launch Daemon. This is mostly used for software updates. Lately when creating a dmg using hdiutil, I have seen Agent securely ask for the the password and not use the launch daemon.
The Daemon was created first as a test to see what would happen if an LLM had access to one. And under that mode it knew about 50 things it could run as an administrator of the computer. It was never ran in that state. and its 3-4 layers of access were created.
The user can turn of the Launch Daemon and when this happens not only us the Daemon turned off, so are is access to the Launch Daemon tool. This model is used all over Agent! The user can turn off anything. I do plan to harden the Launch Agent and Launch Daemon on off access with Local Authentication and later a Pass-Key to prevent Agent! from turning it back on via things like Accessibility.
I am the creator of Agent! macOS26.4+, and many won't know this but I have been coding AI apps and related tools from scratch for the past 3 years. I wanted to build something specifically for Mac but at an Agentic level.
I'll remove the stars and forks from the banners. The ribbons are emojois. To raise awareness, I have stage 2 (T2) bladder Cancer. I have been extremely sick the past two weeks. Agent was created a month ago. But most of the work that was done in the past 3 years has been applied to Agent.
If you want to be completely save, Agent does run on a macOS VM, but without any help from Apple Intelligence which runs various things locally. Some parts of Apple AI like Triage/Mediator are experimental.
I chose macOS26 because no one else claimed it and wanted to make it clear what version of macOS the user needed. You'd be surprised how many people still asked if it ran on 10.14 Mojave.
I mean, the name was changed ten years ago...
Personally, I wish Apple would stop creating a new OS yearly. Most features users use were born in System 7/8/9 days.
But to answer the question: Yes! I opened thinking it was going to be some awesome Leopard or Lion app.
I miss the name, mostly because the OS was interesting and fun in those days and boring and dreary and buggy and low contrast and poor UX and squircles and flat colours if it even has colours now.
What is a harness? People have been talking about it and couldn’t glean what it is
You can see this in practice by looking at the leaked Claude Code source code. It is a harness around Anthropic's model built for writing code. It relies on heavily engineered (and sometimes brittle) steering mechanisms. These range from highly specific situational prompts to deterministic, hard-coded logic that executes based on the model's output.
Getting a harness right is incredibly hard and feels like whack-a-mole at times.
Looks me off an on three years to realize I was doing it backwards. Agent was originally born after I re-wrote CloneTool, a more generic Disk Cloning too with an SMAppService Launch Daemon.
After I completed CloneTool, I was like mmmmm what is I connected an LLM to the Daemon? It rattled of 50 things it could do and it had no knowledge of this anywhere in the harness, system prompt or tools. It simply had figured out its environment on its own.
I never ran Agent under that scenario it definitely has a hardness now. And yes getting the hardness right is a number one challenge and once you do get it working good with most LLMs out of the box, you try not to change it because that sweet spot is hard to come by. Not to say it never gets tweaked but the further in you go, the more you chringe on a change that may break it.
And there are over 17+ LLM Providers within Agent including local and cloud based solutions offered by Zai, HuggingFace, Ollama, etc.
I agree on the token part. Until I incorporated Oauth for CC, I used mostly Zai GLM5-1 and used Ollama and Huggingface as fallback which is a new feature called "Fallback chains".
'claude setup-token'
Or a lawsuit, given macOS is a trademark.
The goal to emphasize that it was built for macOS26 users.
The original website is https://agent.macOS26.app and it clear states it's for macOS26 even thought I still get users asking if it works with El Cap a tan.
I'm sorry to hear this, but I'm also surprised that this is the first thing I learnt about this project, and that it is written in the third person. It detracts from the project.
Asking for stars and forks is where it gets weird. I understand a crowdfunding program but how is this going to help?
Makes it even weirder that this is a completely anonymous, we don't know who works on it, and actually the project pretends to be authored by "AI". look at commit history and contributors
I don't want to be cynical here, my dad was diagnosed with cancer too but this just feels like some LLM was given a prompt to maximize stars and forks and this is how that went. I am very sorry to say this.
> Our founder, Todd Bruss, is currently battling Cancer. Through it all, he continues to pour his heart into InkPen. Your support and encouragement mean the world.
The author has posted about their project on LinkedIn as well[1].
[0] https://inkpen.io/ [1] https://www.linkedin.com/in/principal-software-engineer-swif...
The username is macOS26. The name is "Agent!". As in "Agentic AI for your entire Mac Desktop". All commits are made by this entity.
Until someone here told me there is a real guy behind it I sincerely gotta say, it looks like there's no human behind the keyboard and actually there's no keyboard at all.
Combined with cancer message on top it made me think some LLM "agent" is trying different tricks because it was prompted to achieve maximum stars and forks. I feel shitty for saying this but how not to be cynical because literally that's what we degraded to thanks to "ai".
AI might increase the volume of shitty things on the internet, but it's not like GitHub accounts weren't anonymous before AI, and it's not like people weren't using scammy tactics to boost their star count before AI.
If the fear of AI turn us into worse people in our interactions, that's kind of on us, not AI
I've had days of fevers, dehydration, nausea, vomiting and still holding down a day job. So please don't be offended by my diagnosis or saying that stars and forks mean the world because it kind of does.
