In development · CAD design, the first build will differ
Breaker
by Orkhon
The circuit breaker for AI agents.
Founder’s Edition $199. No campaign live, nothing charged.
A palm-sized box on the one network cable between your agent computer and your router. It keeps the agent’s keys out of its reach, trips when the agent acts like it never should, and has a handle that cuts the agent off in hardware.
Put the brake where the agent can’t reach it.
The first brake that understands agent traffic, does not need the agent’s cooperation, and is priced for the computer on a desk.
The launch film
The stop button is on the agent’s computer.
Agents now get a computer of their own. Apple sells the Mac mini as “an always-on desktop for AI agents.” Apple
The brakes come along: system prompts, permission prompts, hooks, approval apps, a proxy on the same machine. Each one works while the agent’s own process agrees to go through it. This year showed what happens when it does not.
-
February 2026
Summer Yue, a Meta AI security researcher, told an OpenClaw agent to suggest deletions. It started deleting her inbox and ignored the stop commands she sent from her phone. “I had to RUN to my Mac mini like I was defusing a bomb.”
TechCrunch -
OpenClaw documentation
OpenClaw’s egress proxy “constrains only cooperating clients.” In the docs’ own words: “A subprocess can ignore those variables and open raw sockets.”
OpenClaw docs -
Claude Code, issue 34449
“Most of the trauma from agent boundary violations comes not from the violation itself, but from being unable to stop it.”
GitHub -
May 4, 2026
Prompt injection made an agent wallet using Bankr’s tools send tokens worth roughly $155,000 to $180,000.
AMBCrypto -
October 2026
In a Salt Security survey of more than 380 professionals, 49.8% had confirmed or suspected unexpected agent activity. Only 17.5% could stop an agent automatically.
Campus Technology -
October 22, 2026
OpenClaw’s maintainers closed an issue on approvals, which “are not a per-user auth boundary,” as not planned.
GitHub
NVIDIA drew the same line for data centers. Its Sentry watches agents from separate processors and works “without the host’s cooperation.” StorageReview It is planned for servers early next year. NVIDIA Breaker puts that line on your desk.
Down is off.
The handle is a real switch. Pull it down and its contact cuts power to the network chip of the agent port. The agent can keep trying. There is no link to try on.
No software, Breaker’s own included, can power that port while the handle is down. Up again, and the supervisor chip decides when the port comes back.
Four jobs, none of them on the agent’s computer.
Breaker does its work where the agent cannot reach: on the cable, and in a chip the network never touches.
-
Vault
The keys live in the box.
Your real API keys and OAuth tokens are stored in Breaker, sealed by a key in a secure element. The agent computer holds placeholders. On the way out, Breaker swaps a placeholder for the real secret, and only toward the hosts that secret belongs to.
Setup will refuse to finish while a known config file on the host still holds a plain key. A stolen config file then holds nothing worth stealing.
ARMED. Sample data. -
Trip
It trips like a breaker.
Breaker reads the API traffic you choose to govern and trips when an agent acts at a rate or in a place it never should: a mass delete, a first upload to a host it has never seen, model spend past your cap.
Governed calls then get HTTP 423 with the reason, and the model stays reachable, so the agent can explain itself. A person resets it: handle down, then up.
TRIPPED. Sample data. Deletes are counted by message ID, which needs Breaker’s certificate on the host. -
Handle
A cut you can see from across the room.
Down cuts the agent port and seals the vault. The face says so, and the CONFIRM ring goes dark, because with the port cut there is nothing to release. The app can cut too. Bringing the port back takes the handle, or a passkey plus a delay.
CUT. Sample data. -
Receipts
Every governed action leaves a record the agent cannot edit.
Breaker writes an append-only log, each entry chained to the last and signed by the secure element: method, host, path, rule, decision, sizes, response status. You can export it as JSON Lines.
A receipt says what Breaker saw and what it did. It does not claim to know what the agent meant.
14:07:12DELETEgmail.googleapis.com
rulemail.mass_delete
decisiontrip, 423
prev4c1e…09ab
signeddevice key
One receipt entry. Sample data.
It shows you the request. Your thumb sends it.
Some actions should never run on their own: a payout, a merge to main, a bulk send. Breaker holds the exact request and draws its own reading of it on the face: the service, the amount, the recipient.
Hold CONFIRM for one second and Breaker sends exactly those bytes. If one byte changes, nothing goes out. Away from the desk, Breaker Cloud brings the same hold to your phone.
Hold CONFIRM for one second
One cable in, one cable out.
Breaker goes between the router and the agent computer, like the breaker between the grid and a circuit. The agent computer’s only way out is the cable through it, so turn its Wi-Fi off.
- Internetand your router
- WAN
- Breakerreads, holds, cuts
- AGENT
- Agent computerMac mini, Mac Studio, Linux box. Wi-Fi off.
- Bulk traffic
- Passes on its server name. Breaker does not open it.
- Governed APIs
- Opened, checked against your rules, given their real keys on the way out.
- Everything else
- Denied by default, per agent.
There is nothing in it to persuade.
Prompt injection works on language models. Breaker runs none. Its rules are code, and its handle is a contact. The parts a person trusts sit behind a line the network cannot cross.
Network side
Linux: bridge, firewall, DNS, TLS proxy, rule engine, receipt log.
Sees the traffic. Can always drop it. Can never power the agent port.
Supervisor chip
The handle, the CONFIRM button, the e-paper face, and the secure element that holds the vault key.
No network cable reaches it. It draws the face from fields it parsed itself.
The face
Shows only what the supervisor parsed from the request. Text an agent writes is never shown as an instruction.
The vault
With the handle down it is sealed, and the supervisor refuses to release a key.
The restore
Needs the handle up and the supervisor’s consent: after a reset, or a passkey plus a delay. Cutting is easy. Restoring takes intent.
Violoop puts a button on its own agent. Breaker puts one on yours.
Violoop, from BVIO in Hong Kong, is a palm-sized AI agent in a box. It reads your screen over HDMI or USB-C, types and clicks as a keyboard and mouse, and runs an 8B model on the device or your own API keys. Before it acts, it waits for a physical button wired to a separate security chip. Violoop PC Guide
“Software running on the same machine it controls cannot give you that separation.”
Buyers pay for that separation. By October 25, 2026, Violoop’s Kickstarter had about HK$23.4 million in pledges, roughly US$3 million, from more than 5,000 backers in under six weeks, at $399 against a planned $699 retail. Kicktraq
| Violoop | Breaker | |
|---|---|---|
| What it is | An AI agent, with an approval gate for its own actions | A guard for the agents you already run |
| Where it sits | On the display and USB ports, as a screen, keyboard and mouse | On the network cable, between the router and the agent computer |
| The button approves | What Violoop is about to do | A held request from any agent on the host |
| Keys | Uses your API keys for its own model calls | Holds the keys of the agents on the host, out of their reach |
| OpenClaw, Hermes, Claude Code on the host | Not what it is for | Reads their traffic, trips them, cuts their port |
| Price | $399 on Kickstarter, $699 planned retail | $199 Founder’s Edition, $249 retail |
As of October 2026, Violoop does not sit on the network wire or police the agents on your computer. A later version could. Breaker is built for that wire alone.
What it does not do.
A box on a wire sees a lot. It does not see everything. Here is where it stops.
It sees only the wire.
Traffic that leaves by Wi-Fi, a tethered phone or an agent hosted in someone else’s cloud never passes through it. Setup asks for an Ethernet-only host.
It reads inside a request only where you install its certificate.
Without it, Breaker sees destinations, rates and sizes. Apps that pin their own certificates are governed by destination only.
It cannot undo what a server already accepted.
A deletion that went through stays deleted. Breaker stops the next one.
Allowed stays allowed.
If your limit is 20 emails an hour, a hijacked agent can send 20. Breaker shrinks the damage. It does not make a bad agent good.
It trusts its own Linux with the keys it injects.
In v1 an API key is decrypted inside Breaker at the moment it is used. A taken-over agent computer never reaches it. A taken-over Breaker could misuse what your rules allow, and the signed receipts would show the mismatch.
A trip is not a verdict.
It means governed traffic waits for a person. Traffic Breaker cannot read is reported as ungoverned, never as safe.
Where it stands.
Breaker is in development. Every picture on this page is a render of the CAD model, not a photo.
v0, the prototype we are building now
Off-the-shelf parts: a Raspberry Pi Compute Module 5 on the network side, a Raspberry Pi Pico 2 as the supervisor, an NXP SE051 secure element, a 2.9-inch e-paper panel, a two-pole toggle and a printed case. 110 by 51 by 81 mm.
v1, the production design
The upright pole in these renders. The handle travels 44 degrees, up for on and down for off, as on a breaker panel. Weight, heat and the time from handle to dead link, with a target under 100 ms, get measured on the first build.
- Stage
- Prototype in build
- Ship date
- Not set. The waitlist hears first.
- Designed in
- Reno, Nevada
Priced for the computer on your desk.
The box works fully offline. Cloud is optional.
-
Founder’s Edition
$199
The first run of Breaker. Join the waitlist to hear when it opens.
Join the waitlist -
Breaker
$249
The retail price, after the Founder’s Edition.
-
Breaker Cloud Optional
$9 a month
Cut from anywhere, approve holds on your phone, get rule-pack updates, keep a year of encrypted receipts.
No payment is taken today. The waitlist is free.
Questions.
Which computers does it work with?
Any agent computer with an Ethernet port: a Mac mini, a Mac Studio, a Linux box. A cloud server can be tunnelled home over WireGuard so its traffic passes through Breaker.
Which agents?
Anything that reaches the network through that cable: OpenClaw, Hermes, Claude Code or Codex in auto mode, browser agents, voice agents. Breaker works on the traffic, not through a plug-in, so the agent does not have to cooperate.
Do I install anything on the agent computer?
For the cut and for destination rules, no. To read inside API requests, you install Breaker’s certificate on the host. To use the vault, you replace your keys with Breaker’s placeholders.
Does it slow the network down?
Bulk traffic passes on its server name without being decrypted. Breaker opens only the API traffic you choose to govern, so it has to keep up with API calls, not with downloads.
What if the agent turns Wi-Fi back on?
Then its traffic goes around Breaker. That is why setup asks for an Ethernet-only host, and why the keys stay in the vault: a bypass then reaches nothing worth having.
What if someone takes over Breaker itself?
The handle still cuts the port, because the cut is a contact, not software. The keys it injects are another matter: see “It trusts its own Linux” above.
Is the software open?
The plan is to publish the rule engine and the rule packs as open source, so anyone can read what is allowed to cut off their agents.
When does it ship?
There is no date yet. The prototype comes first. People on the waitlist hear before anyone else.
Get on the list.
Founder’s Edition, $199. We email you when it opens.
- NowThe waitlist. Free, email only.
- LaterAn early-bird deposit for the Founder’s Edition, offered to the list first.
No campaign is live and no money is charged yet.