In development · CAD design, the first build will differ
Breaker
by Orkhon
The circuit breaker for AI.
Founder’s Edition $199. No campaign live, nothing charged.
A palm-sized box on the one network cable between your agent computer and your router. It keeps the agent’s keys out of its reach, trips when the agent acts like it never should, and has a handle that cuts the agent off in hardware.
Put the brake where the agent can’t reach it.
The first brake that understands agent traffic, does not need the agent’s cooperation, and is priced for the computer on a desk.
The launch film
Renders. In development.
The stop button is on the agent’s computer.
Agents now get a computer of their own. Apple sells the Mac mini as “an always-on desktop for AI agents.” Apple
The brakes come along: system prompts, permission prompts, hooks, approval apps, a proxy on the same machine. Each one works while the agent’s own process agrees to go through it. This year showed what happens when it does not.
-
February 2026
Summer Yue, a Meta AI security researcher, told an OpenClaw agent to suggest deletions. It started deleting her inbox and ignored the stop commands she sent from her phone. “I had to RUN to my Mac mini like I was defusing a bomb.”
TechCrunch -
OpenClaw documentation
OpenClaw’s egress proxy “constrains only cooperating clients.” In the docs’ own words: “A subprocess can ignore those variables and open raw sockets.”
OpenClaw docs -
Claude Code, issue 34449
“Most of the trauma from agent boundary violations comes not from the violation itself, but from being unable to stop it.”
GitHub -
May 4, 2026
Prompt injection made an agent wallet using Bankr’s tools send tokens worth roughly $155,000 to $180,000.
AMBCrypto -
October 2026
In a Salt Security survey of more than 380 professionals, 49.8% had confirmed or suspected unexpected agent activity. Only 17.5% could stop an agent automatically.
Campus Technology -
October 22, 2026
OpenClaw’s maintainers closed an issue on approvals, which “are not a per-user auth boundary,” as not planned.
GitHub
NVIDIA drew the same line for data centers. Its Sentry watches agents from separate processors and works “without the host’s cooperation.” StorageReview It is planned for servers early next year. NVIDIA Breaker puts that line on your desk.
Down is off.
The handle is a real switch. Pull it down and its contact cuts power to the network adapter of the agent port. The agent can keep trying. There is no link to try on.
Up again needs a hand: no message over the network can bring the port back. This is the design. The first bench build tests it, including power leaking back through the data lines, before we claim it on film.
Four jobs, none of them on the agent’s computer.
Breaker does its work where the agent cannot reach: on the cable, and in a chip the network never touches.
Coming in the app: stop or restart your agent from your phone; restart needs your signed OK, never the agent. Agent crypto wallet: in development.
-
Vault
The keys live in the box.
Your real API keys and OAuth tokens are stored in Breaker, sealed by a key in a secure element. The agent computer holds placeholders. On the way out, Breaker swaps a placeholder for the real secret, and only toward the hosts that secret belongs to.
Setup will refuse to finish while a known config file on the host still holds a plain key. A stolen config file then holds nothing worth stealing.
-
Trip
It trips. The handle stays where it is.
Breaker reads the API traffic you choose to govern and trips when an agent acts at a rate or in a place it never should: a mass delete, a first upload to a host it has never seen, model spend past your cap.
Governed calls then get HTTP 423 with the reason, and the model stays reachable, so the agent can explain itself. The face shows TRIPPED and the ring turns red; nothing moves by itself. A person resets it: handle down, then up.
The face after a trip. Firmware render. DEMO marks a simulated run; the hardware shows OPEN BENCH. -
Handle
A cut you can see from across the room.
Down cuts the agent port and seals the vault. The face says OFF, and the ring on the button goes dark, because with the port cut there is nothing to release. Cutting can come from anywhere. Bringing the port back takes a hand on the handle, every time.
The face with the handle down. Firmware render. DEMO marks a simulated run; the hardware shows OPEN BENCH. -
Log
Every governed action leaves a record the agent cannot edit.
Breaker writes an append-only log, each entry chained to the last: method, host, path, rule, decision, sizes, response status. You can export it as JSON Lines.
A log entry says what Breaker saw and what it did. It is not a receipt from the other side, and it does not claim to know what the agent meant.
14:07:12DELETEgmail.googleapis.com
rulemail.mass_delete
decisiontrip, 423
prev4c1e…09ab
One log entry. Sample data.
It asks you first, on its own screen.
Some actions should never run on their own: a payment, a merge to main, a bulk send. Breaker holds the request and shows a short summary on its face: the action, the amount, the payee. Text the agent wrote is never shown.
- HeldThe face shows the payment, $1,840.00 to an account ending 4471. The ring on the button pulses amber.
- PressPress the button on top with one finger and hold it for a second to let it through.
- Anything elseA changed request is a new question. Don’t press, and it never goes: the hold ends after 60 seconds.
Faces from the firmware renderer, sample data. DEMO marks a simulated run; the hardware shows OPEN BENCH.
One cable in, one cable out.
Breaker goes between the router and the agent computer, like the breaker between the grid and a circuit. The agent computer’s only way out is the cable through it, so turn its Wi-Fi off.
- Internetand your router
- ROUTER
- Breakerreads, holds, cuts
- AGENT
- Agent computerMac mini, Mac Studio, Linux box. Wi-Fi off.
- Bulk traffic
- Passes on its server name. Breaker does not open it.
- Governed APIs
- Opened, checked against your rules, given their real keys on the way out.
- Everything else
- Denied by default, per agent.
There is nothing in it to persuade.
Prompt injection works on language models. Breaker runs none. Its rules are code, and its handle is a contact. The parts a person trusts sit behind a line the network cannot cross.
Network side
Linux: bridge, firewall, DNS, TLS proxy, rule engine, log.
Sees the traffic. Can always drop it. Can never power the agent port.
Supervisor chip
The handle, the button, the e-paper face, and the secure element that holds the vault key.
No network cable reaches it. It draws the face from fields it parsed itself.
Supervisor code: open source. The firmware of the side that holds the handle, the button and the face, with its protocol, simulator and tests. GitHub
The face
Shows only what the supervisor parsed from the request. Text an agent writes is never shown as an instruction.
The vault
With the handle down it is sealed, and the supervisor refuses to release a key.
The restore
Needs a hand: handle down, then up, with the supervisor ready. No message over the network can do it. Cutting is easy. Restoring takes intent.
Violoop puts a button on its own agent. Breaker puts one on yours.
Violoop, from BVIO in Hong Kong, is a palm-sized AI agent in a box. It reads your screen over HDMI or USB-C, types and clicks as a keyboard and mouse, and runs an 8B model on the device or your own API keys. Before it acts, it waits for a physical button wired to a separate security chip. Violoop PC Guide
“Software running on the same machine it controls cannot give you that separation.”
Buyers pay for that separation. By October 25, 2026, Violoop’s Kickstarter had about HK$23.4 million in pledges, roughly US$3 million, from more than 5,000 backers in under six weeks, at $399 against a planned $699 retail. Kicktraq
| Violoop | Breaker | |
|---|---|---|
| What it is | An AI agent, with an approval gate for its own actions | A guard for the agents you already run |
| Where it sits | On the display and USB ports, as a screen, keyboard and mouse | On the network cable, between the router and the agent computer |
| The button approves | What Violoop is about to do | A held request from any agent on the host |
| Keys | Uses your API keys for its own model calls | Holds the keys of the agents on the host, out of their reach |
| OpenClaw, Hermes, Claude Code on the host | Not what it is for | Reads their traffic, trips them, cuts their port |
| Price | $399 on Kickstarter, $699 planned retail | $199 Founder’s Edition, $249 retail |
As of October 2026, Violoop does not sit on the network wire or police the agents on your computer. A later version could. Breaker is built for that wire alone.
What it does not do.
A box on a wire sees a lot. It does not see everything. Here is where it stops.
It sees only the wire.
Traffic that leaves by Wi-Fi, a tethered phone or an agent hosted in someone else’s cloud never passes through it. Setup asks for an Ethernet-only host.
It reads inside a request only where you install its certificate.
Without it, Breaker sees destinations, rates and sizes. Apps that pin their own certificates are governed by destination only.
It cannot undo what a server already accepted.
A deletion that went through stays deleted. Breaker stops the next one.
Allowed stays allowed.
If your limit is 20 emails an hour, a hijacked agent can send 20. Breaker shrinks the damage. It does not make a bad agent good.
It trusts its own Linux with the keys it injects.
In v1 an API key is decrypted inside Breaker at the moment it is used. A taken-over agent computer never reaches it. A taken-over Breaker could misuse what your rules allow, and the log would show the mismatch.
A trip is not a verdict.
It means governed traffic waits for a person. Traffic Breaker cannot read is reported as ungoverned, never as safe.
Where it stands.
Breaker is in development. Every picture on this page is a render of the CAD model, not a photo.
v0.2, the prototype we are building now
Off-the-shelf parts: a Raspberry Pi Compute Module 5 on the network side, a Raspberry Pi Pico 2 as the supervisor, an NXP SE051 secure element, a 2.9-inch e-paper panel, a USB network adapter, a relay, a two-pole toggle and a printed case. 120 × 99.5 × 81 mm in CAD.
Then v1, the production design
A moulded version of the v0.2 box, on one main board. Weight, heat and the time from handle to dead link, with a target under 100 ms, get measured on the first build.
- Stage
- Prototype in build
- Ship date
- Not set. The waitlist hears first.
- Size
- 120 × 99.5 × 81 mm (v0.2 CAD, width × depth × height)
- Designed in
- Reno, Nevada
Priced for the computer on your desk.
The box works fully offline. Cloud is optional.
-
Founder’s Edition
$199
The first run of Breaker. Join the waitlist to hear when it opens.
Join the waitlist -
Breaker
$249
The retail price, after the Founder’s Edition.
-
Breaker Cloud Optional
$9 a month
Cut from anywhere, approve holds on your phone, get rule-pack updates, keep a year of encrypted logs.
No payment is taken today. The waitlist is free.
Questions.
Which computers does it work with?
Any agent computer with an Ethernet port: a Mac mini, a Mac Studio, a Linux box. A cloud server can be tunnelled home over WireGuard so its traffic passes through Breaker.
Which agents?
Anything that reaches the network through that cable: OpenClaw, Hermes, Claude Code or Codex in auto mode, browser agents, voice agents. Breaker works on the traffic, not through a plug-in, so the agent does not have to cooperate.
Do I install anything on the agent computer?
For the cut and for destination rules, no. To read inside API requests, you install Breaker’s certificate on the host. To use the vault, you replace your keys with Breaker’s placeholders.
Does it slow the network down?
Bulk traffic passes on its server name without being decrypted. Breaker opens only the API traffic you choose to govern, so it has to keep up with API calls, not with downloads.
What if the agent turns Wi-Fi back on?
Then its traffic goes around Breaker. That is why setup asks for an Ethernet-only host, and why the keys stay in the vault: a bypass then reaches nothing worth having.
What if someone takes over Breaker itself?
The handle still cuts the port, because the cut is a contact, not software. The keys it injects are another matter: see “It trusts its own Linux” above.
Is the software open?
The plan is to publish the rule engine and the rule packs as open source, so anyone can read what is allowed to cut off their agents.
When does it ship?
There is no date yet. The prototype comes first. People on the waitlist hear before anyone else.
Your agent can be talked into anything. A switch can’t.
Get on the list.
Founder’s Edition, $199. We email you when it opens.
- NowThe waitlist. Free, email only.
- LaterAn early-bird deposit for the Founder’s Edition, offered to the list first.
No campaign is live and no money is charged yet.