HOL Guard: Open-Source Antivirus for AI Agents

Post Views: 10

HOL Guard is a free, open-source solution designed to act as an intermediary between an AI assistant and the host system.

Installation

Installation requires approximately one minute, operates locally on the user’s machine, and performs checks in under 50 milliseconds. All operations occur without internet connectivity, and user data remains on the device without being transmitted. The tool is compatible with platforms including Claude Code, Cursor, Codex, Gemini CLI, OpenCode, Hermes, and OpenClaw.

Configuration Modes

The default configuration, termed “Balanced,” is engineered to minimize disruptions while addressing high-risk activities. This mode triggers alerts for actions such as unauthorized data exfiltration, destructive or encoded execution, prompt injection, risky API calls, malicious plugins, and persistence mechanisms. It also issues warnings for network egress, package scripts, and attempts to circumvent HOL Guard’s protections. Additional settings—Gentle, Strict, and Paranoid—offer varying levels of scrutiny. Strict mode introduces alerts for low-confidence threats, while Paranoid mode halts any unfamiliar activity from external tool servers. Neither Strict nor Paranoid is enabled by default, as their frequent interruptions may lead to user uninstallation.

Security Features

Michael Kantor, president of HOL, emphasized that concealing detection signatures is not a viable security measure. While some detection rules are openly documented, the system also analyzes behavioral patterns. This includes examining command structures across wrappers, pipelines, and embedded commands, as well as monitoring executable provenance, sensitive file access, network destinations, and attempts to bypass HOL Guard.

Kantor acknowledged that pattern matching remains a component of the system but noted it is one of multiple inputs. While adversaries could rephrase commands to evade basic checks, circumventing behavioral analysis is significantly more challenging.

User Adoption

Kantor stated that users must manually adjust settings based on their experience, as no centralized metrics exist to quantify mode transitions.

User adoption metrics remain unspecified due to the tool’s privacy-focused design. Local telemetry and cloud synchronization are disabled by default, preventing the collection of usage data. The tool logs all allowed and blocked actions locally, allowing users to review decisions and reverse blocked events with a single approval. This record serves as the sole evidence of the system’s effectiveness within a user’s environment, as no external entities monitor activity.

Conclusion

HOL Guard is available at no cost through GitHub. The solution prioritizes user control and transparency, offering a framework for managing risks associated with AI agents without compromising privacy or usability.