Human Check for AI Agents

AI agents can be incredibly useful, but their autonomous actions can be incredibly dangerous if not adequately controlled. Max Brin is developing a product that intercepts agent intentions and forces human approval before risky actions proceed. It's a layer of oversight designed to keep autonomous agents accountable, secure, and aligned with user intent when they perform real-world actions.

An AV for AI

Brin describes his product as an 'AV for AI', a designation that might cause confusion since it doesn't work like traditional antivirus software. The name OpenLeash is more descriptive: it keeps a controlling leash on unexpected and unwelcome actions that can be caused by AI agents.

The product runs alongside the agent and provides an authorization layer aimed at keeping autonomous AI agents accountable, secure, and aligned with user intent when they perform real-world actions. It is designed to be a guardian angel, intercepting all conversations between an agent and network assets.

The Problem: Inherited Permissions, No Situational Awareness

Agents tend to inherit the permissions of their user, but they do not inherit any human situational awareness. This gives them wide access and generous permissions across the network, and a single bad prompt, malicious tool, or compromised model can cause real damage. OpenLeash intercepts agent intentions to mitigate this risk.

Depending on the configuration applied by the user, OpenLeash monitors the agents' actions and where necessary asks the user if the action by the agent should be allowed. If no, that action is paused. If yes, it is allowed. Brin describes it as 'medication for AI anxiety'.

Example: Silent Database Deletion

Brin gives an example of the product in action. A misconstrued command, or an error in the agent coding, could cause it to silently delete a database without any human awareness. OpenLeash steps in to prevent that scenario.

“When it intends to delete my database, Leash intercepts this message, evaluates it, and tries to understand if the action is risky or not. In some cases, it’s definitely risky, and Leash will just block it immediately. But in other cases where Leash is not sure, it asks the user: did you intend to delete your entire database – or did you intend to upload your credentials to this or that or those websites. Basically, it’s like a guardian angel that intercepts all the conversations between an agent and network assets. It does this on in-house agents, on cloud agents and on third-party agents, and then it helps users decide if they really want the agent to take that specific action.”

— Max Brin, developer of OpenLeash

This capability addresses the core issue: the agent alone doesn't behave as if it needs to ask permission to do something; it's just performing the instructions it has as it interprets them and does what it is told. OpenLeash is designed to provide a permission layer in the action, regardless of the agent's interpreted commands.

Already in Active Use

While OpenLeash is still described as under development, it is also in active use. Brin has a list of planned additions and improvements that he suspects will take a couple of months to complete. Meanwhile, the existing product is already in active use by several hundreds of personal users and at least four organizations.

The product is highly configurable. Acceptable API endpoints, destinations or payment limits can be specified in the configuration. For example, payments below a certain threshold can be allowed to proceed, while payments above that threshold will need to be authorized by a human in the loop. The configuration can be amended at any time.

Relevance to Vibe Coders

Brin sees OpenLeash as especially relevant to the new class of vibe coders. These are people who want to use AI to create software and applications without traditional coding or cybersecurity knowledge.

“AI is bringing us the ability to code and write software, even if we don’t know how to write a single line of code, and have zero understanding of cybersecurity,” he says. “There are people who want to write software and create applications or agents to automate their own workload. They have ideas, and they’re a bit like entrepreneurs but with no technical knowledge. They download Claude Code or Cursor to develop AI agents to do what they want, and then turn to OpenLeash to control the agents.”

Why It Matters

The risks posed by autonomous AI agents are not hypothetical. As more users – particularly those without deep technical backgrounds – deploy agents that can interact with networks and systems, the potential for costly mistakes grows. OpenLeash represents a pragmatic approach to adding a human check to those actions, but it also highlights the broader challenge: the industry still lacks robust, standardized safeguards for agentic AI. Until more solutions mature, organizations and individuals must consider their own oversight mechanisms, or risk discovering the consequences of an unchecked agent the hard way.