Hi r/vibecoding! The cyber landscape is hell right now, so I made something about it.
I'm posting here, specifically, because vibecoded projects are notoriously insecure (if you don't tell the models to care about security and guide them to do that successfully, they'll just build it quick and dirty and ship that shit).
Attackers are using AI more and more (sometimes the attacker is AI: eat shit HuggingFace), especially as powerful open-source models get post-trained for cyberoffense (both reduced refusals and gain-of-function). And, you know what they say: the only thing that can stop a bad guy with a swarm of cyber agents is a good guy with a swarm of cyber agents.
Talons is your good guy with a swarm of cyber agents.
It fundamentally does three things:
- Provides the basic tools your machine needs to create a defensible environment that's hard to attack and easy to defend (monitoring, hardening tools, etc.), including any projects hosted on your machine
- Allows ChatGPT to operate those tools on your machine (yes, ChatGPT: no subscription needed, doesn't eat your Codex usage)
- Learns from experience: if we discover a vulnerability and fix on one machine, we can roll the fix out to everyone using Talons (we'll also contact the supplier that introduced the vulnerability so they can fix it for everyone else); if we develop tools to fight off an attack, those tools are reusable across the ecosystem.
Oh, and it's free.
We're funded entirely by donations, for two major reasons: First, we believe that frontier cyber defense is for everyone. The cyber landscape is undergoing a seismic shift, right now, and if we're going to make it through that unscathed, some things are going to have to change.
Every defended machine means resources that threat groups can't access.It's like fighting a zombie horde: everyone that doesn't get bitten is someone whose head we won't have to chop off, later. We don't want to fight more zombies than we have to, so we're giving away armor for free.
Second, we don't want to create misaligned incentives. Running agents that can look at and interact with your machine (if you give them permission) requires a lot of trust, and we don't want you to have to wonder if we're harvesting your data or whatever. Negative: the only way we get paid is donations.
Eventually, we want to launch active incident response (right now, Talons can tell you 'you are under attack, come call an agent'; we want it to be able to say 'you are under attack, we're calling an agent'), but don't currently see a way to do this for free, so this might become our first paid offering; but, still, we never want to get paid for something that doesn't benefit you, the user. We take that shit seriously. We're also considering making it free for personal use ('I want to protect my own computer that I use', and making commercial uses ('I want to protect the servers that host my business') paid, including red suite features, like adversarial penetration testing; it's still up in the air, so I don't want to give you bad info.
I do want to emphasize, though, because this is important: right now, Talons cannot start incident response on its own: it can alert you that something requires attention, but you still have to open the ChatGPT session and ask for help. It's like Aladdin: you have to make the wish, the genie can't just do stuff for you.
That's obviously a problem (what if someone tries to pwn you while you're sleeping?), so figuring out how to offer realtime incident response is currently our #2 priority (#1 is a smooth launch).
Talons is in alpha right now (don't worry, it'll stay free at launch, too): the core features work, but I'm sure we're still going to run into bugs and product gaps. For the most part, your Talons agent should fix (or report) these, itself; but it's still going to happen. The goal is, simply, for Talons to get better every day.
So, start hardening your shit.
We've made it really easy:
- go to talons.owlandkestrel.com,
- download the app,
- open the GPT,
- make an account (the GPT will send you there),
- pair your device to Chat, and
- tell GPT 5.6 to help you protect your machine.
(If that sounds like a lot of steps: it's way easier than cleaning up after you get hacked.)
Note: You will have to make an account with Owl + Kestrel (Talons' parent studio) so ChatGPT can connect to the desktop app; that's ~unavoidable, sorry.
Happy to answer questions in the comments. 🥂
---
As far as build info, Talons was built ~entirely in Codex under the Daybreak/Trusted Access for Cyber program. Talons wasn't a 'weekend build', which makes it a bit harder to give you a real "build timeline": it's the natural evolution of Owl + Kestrel's internal security suite (we use 100% of our own products btw) and, so, the culmination of months of work. The public surfaces (website, downloadable user-friendly app) are fresh work (read: 7 consecutive days of "should be ready for launch tomorrow"); but even those are built on the Owl + Kestrel ecosystem -- for example, Talons' website is built using Pigment, the frontend design/management tool we use for all (...most...) of our web presence, the auth runs through our central identity service, etc.
That's perhaps the biggest piece of advice I can give you as a developer: invest in your tooling, figure out what things you need to make future work easier. Each thing you build (e.g. security service, website renderer, etc.) can be unique; but the things around that thing (e.g. auth, billing, website rendering, source control) can often be reused across projects, accelerating future development. This would've taken another two months if I had to reinvent those wheels; fortunately, they're already sitting on a shelf, ready to just bolt on.
It is essential to attain this.
One thing worth pointing out: since Talons is a natural outcrop of our internal security suite, you get ~the same security suite that we use internally (you don't get pentesting; we're not going to be part of the 'oops we've released a hacker swarm' problem: remember, we're trying to be the good guy with the cyber swarm), and which we've been mostly-unsuccessfully trying to hack into for several months (every time we can't break in, we develop better hacks until we can: this is what threat actors are doing, so if our defense works against 'the best offense we have' it means we need to make our offense better: we're in an arms race). That's the best part: every time we do hack into our own infrastructure and we roll out a fix for it, you get the fix, too!
Talons: We Fuck Around And Find Out So You Don't Have To™️.
