Claude Mythos
doesn't sleep.
Neither does your defense.

Prerequisites

Autonomess targets Python 3.11. The runtime is claude-agent-sdk 0.1.58; no other model providers are supported.

• Python 3.11 (pinned; tested on 3.12/3.13)
• uv 0.11+ for project + virtualenv management
• Obsidian 1.12+ with the official command-line interface enabled
• Pentest CLIs available on $PATH: nmap, nikto, sqlmap, ffuf, nuclei, gobuster
• stdbuf (coreutils on Linux; brew install coreutils on macOS)
• notebooklm-py CLI authenticated (research integration)
• An ANTHROPIC_API_KEY in .env

First Mission

Drop a scope file in your working directory and launch the architect. The scope contract — allow-list of targets, exclusions, policy bounds, optional notification webhook — is loaded once at boot and enforced on every tool call by the scope guard.

CLI Reference

Common run flags

scope.yaml

Refuse-by-default. If a target isn't on the allow-list, it cannot be reached, ever — the scope guard intercepts at the PreToolUse hook before any subprocess fires. The contract is the operator's instrument; the Architect cannot mutate it mid-mission.

Vault Tools

Memory is layered and promoted explicitly. Sub-agents land raw evidence; the Architect promotes only verified knowledge into the operator-facing zones. Every write passes through a single-writer queue with a file lock — concurrent agents cannot corrupt the vault.

Architecture

The system is composed of an Architect agent that orchestrates two dispatch shapes — independent Sub-Agents and collaborative Agent Teams — over a transparent event bus, with all memory persisted to an Obsidian vault behind a single-writer queue.

┌─────────────────────────────────────────────────────────┐
│                     ARCHITECT (Claude)                  │
│         plans · dispatches · arbitrates · reports       │
└──────────┬──────────────────────────┬───────────────────┘
           │ Agent tool               │ Agent tool
           ▼                          ▼
   ┌───────────────┐          ┌─────────────────┐
   │ SUB-AGENTS ≤6 │          │ AGENT TEAMS ≤4  │
   │ parallel,     │          │ collaborative,  │
   │ isolated ctx  │          │ shared via vault│
   └───────┬───────┘          └────────┬────────┘
           │                           │
           ▼                           ▼
   ┌─────────────────────────────────────────────┐
   │ PreToolUse / PostToolUse hooks              │
   │  → ScopeGuard refuse-by-default             │
   │  → StreamEvent → Textual RichLog panes      │
   └─────────────┬───────────────────────────────┘
                 ▼
        ┌─────────────────┐       ┌──────────────┐
        │   VaultWriter   │──────▶│ Obsidian CLI │
        │ (single writer) │       │   1.12+      │
        └─────────────────┘       └──────────────┘

Architect Agent

The Architect is the only agent with the Agent tool. It owns mission decomposition, dispatch decisions, and final reporting. It does not run pentest tools directly — it orchestrates specialists who do.

• Model: claude-opus-4.7 — Anthropic's most capable model. Mythos-class adversaries run on frontier reasoning; the Architect must match that weight class to plan against them.
• Inputs: mission objective, scope, vault head pointer, prior-loop summary
• Outputs: agent dispatches, mission report, vault writes via the librarian

Sub-Agents

Up to six concurrent. Each receives a fresh 200K-token context and a single, narrow objective. Only the final message bubbles back to the Architect — intermediate reasoning lives in the vault and the live stream.

Default personas:

• recon-agent — surface mapping, port + service discovery
• enum-agent — credentialed/uncredentialed enumeration
• scan-agent — vulnerability scanning, CVE lookup
• research-agent — NotebookLM dispatch, attack-pattern lookup
• librarian-agent — vault dedup, promotion, index maintenance

Agent Teams

Teams are the mechanism for depth work — exploitation, drill-down, multi-step attack chains. The SDK has no first-class team primitive, so Autonomess simulates one through the vault: each member reads/writes a shared wiki/attack-chains/chain-X.md note. The librarian enforces dedup.

Transparency Pipeline

Every tool call passes through PreToolUse and PostToolUse hooks. The hooks emit a structured event tagged with the originating agent_id and its parent dispatch, which the Textual app routes to the correct pane via post_message.

Vault System (Karpathy-RAG)

Memory is layered. Information is born in raw/, distilled in workbench/, promoted to wiki/ only when verified, and exported to output/ for the operator.

Scope Guard

Refuse-by-default. The guard hooks PreToolUse, parses the tool's target argument (nmap's host list, curl's URL, etc.), and blocks if the target is not in scope. The Architect cannot override.

NotebookLM Research

Any agent can dispatch a research-agent mid-mission. It shells out to notebooklm-py, asks a focused question, and writes the answer to wiki/research/{topic}.md via the librarian. Subsequent agents read the wiki entry instead of re-querying.

Boot Sequence

1. Parse CLI args, load .env
2. Bind structlog contextvars (mission_id, loop)
3. Load + validate scope.yaml
4. Spawn VaultWriter background task; acquire vault lock
5. Run vault doctor — abort on FAIL
6. Build ClaudeAgentOptions (hooks, MCP servers, agent registry)
7. Launch Textual TUI; subscribe panes to event bus
8. Architect receives mission objective; loop begins

Mission Loop

1. Plan — Architect inspects vault head, drafts next step
2. Dispatch — Architect calls Agent tool, spawning specialists
3. Execute — Sub-agents/teams run tools (scope-checked, streamed)
4. Persist — Findings flow into raw/ and workbench/
5. Distill — Librarian promotes verified facts to wiki/
6. Decide — Architect evaluates: continue, pivot, or report
7. Loop until objective met or budget exhausted

Tech Stack

Build Phases

Troubleshooting