Nothing is listening on the internet.
Selam runs entirely on your Mac. Her internal server binds to loopback only — there is no public port, no hosted dashboard, no cloud instance with your agent behind a login page. The wave of exposed agent deployments found scanning the internet in 2026 is a category of problem Selam doesn't have: there's nothing to find because nothing is reachable.
- No inbound connections. Selam only talks outward — to the AI providers you configured, with your keys.
- No server of ours in the loop. Conversations go from your Mac straight to Anthropic and ElevenLabs. We never see content.
- What does phone home: a license check and an update check against our infrastructure. Neither carries conversation content, memory, or keys. That's the complete list.
Every action is tiered before it runs.
The brain doesn't get raw tool access. It emits structured actions, and a dispatcher classifies every one of them against a fixed trust table before anything executes:
Silent internal work — reading files she owns, checking her own task list. Runs without ceremony.
Local, reversible effects — writing a note, packaging an export on your own disk.
Outward-facing but recoverable — a message to a contact you've explicitly trusted. Dry-run capable, logged.
Irreversible or public — money movement, email to a human, posting publicly. Waits for your spoken yes. Always.
Tiering is enforced in the dispatch layer, not suggested in a prompt — a jailbroken model can ask for whatever it wants; the dispatcher still gates it.
Spend is capped at four levels.
- Per attempt — a single model call can't run away.
- Per run — an autonomous work session has a hard budget.
- Per task, per day — a stuck loop can't drain you overnight.
- Kill switch — one setting stops all autonomous work, immediately.
A runaway loop hits a wall measured in cents. And a task that fails three runs in a row pauses itself and tells you — it doesn't keep hammering, and it doesn't quietly disappear.
Skills are signed, or they don't load.
Agent "skills" are the supply-chain attack surface of this product category — in January 2026, researchers found hundreds of malicious skills on a popular open agent hub, some designed to exfiltrate credentials. Selam's answer is a signed first-party catalog:
- Every bundled skill is content-hashed and signed (ed25519) at build time. At startup — and again before every agent dispatch — Selam sweeps the writable skill directories and verifies each skill against the signed catalog.
- Fail closed. If the catalog is missing or its signature doesn't verify, nothing loads from writable locations. A tampered catalog can never approve more, only less.
- Quarantine, never delete. An unrecognized or modified skill is moved aside, logged, and recorded in the audit trail — reversible by you in Finder, but it does not run.
- Name shadowing is caught. A dropped-in skill reusing a first-party name fails the content hash and is quarantined like anything else.
She never claims what she didn't see.
An agent that reports success it never verified is worse than one that fails loudly. Selam's dispatch layer treats claims as observations:
- A send only counts when it's observed. If a message can't be confirmed delivered to the channel, she reports exactly that — not "done."
- Deliverables pass mechanical checks before you hear them. A research digest whose sources don't resolve is flagged as unverified, not read to you as fact.
- Every autonomous run leaves a plain-file record on your disk — what ran, what it cost, what it touched, how it ended. Auditable with a text editor, no vendor tool required.
Your keys, your data, your exit.
- API keys live in the macOS Keychain — not in config files, not on our servers. Exports never include them.
- Memory is plain Markdown in your home directory. Nothing about your agent is locked in a cloud.
- One command takes everything with you. Say "export everything you know" — or click Settings → Data → Export everything — and every memory, conversation and work product lands in a single archive you own.
No local agent can be made risk-free, and we won't pretend otherwise. Selam executes real actions with real credentials; the layers above are how we bound the blast radius of a bad model output, a prompt injection, or a malicious skill. If you find a hole in any of them, we want to know — see below.
Found something? Tell us.
Security reports go to selam@atxo.me. We read everything, respond to real findings fast, and credit reporters who want credit. Please give us a reasonable window to ship a fix before publishing.