HOL has released HOL Guard, an open-source antivirus tool designed to operate between an AI assistant and the host computer. The tool, which installs locally and does not require an internet connection, aims to protect users from risky actions by AI agents by pausing potentially dangerous commands and seeking user approval. HOL Guard is compatible with several AI assistants, including Claude Code, Cursor, Codex, Gemini CLI, OpenCode, Hermes, and OpenClaw.
The software processes commands in under 50 milliseconds and does not upload user files. It offers four security settings: Gentle, Balanced, Strict, and Paranoid. The default setting, Balanced, is designed to prompt users for confirmation on actions such as secret or data exfiltration access, destructive or encoded execution, prompt injection attempts, dangerous MCP calls, malicious skills, and persistence mechanisms. It also warns about network egress and package scripts, and blocks attempts to bypass HOL Guard itself.
Strict mode adds warnings for low-confidence signals, while Paranoid mode interrupts any unfamiliar action originating from an external tool server. Michael Kantor, president of HOL, stated that the design goal was to provide protection without rendering the AI agent unusable. He acknowledged that while some detection signatures are simple and publicly visible in the source code, the system also relies on behavioral analysis. This includes parsing command structures across wrappers, pipelines, redirects, and embedded commands, as well as monitoring executable and environment provenance, sensitive-path access, network destinations, artifact identity and hash changes, and explicit bypass attempts. Kantor clarified that the tool still incorporates pattern matching as one of several inputs.
HOL Guard's effectiveness relies on continuous operation, and the company recognizes that tools that generate too many interruptions may be uninstalled. Due to its privacy-centric design, which disables local telemetry and cloud sync by default, HOL cannot track user adoption rates for different security modes or determine how many users keep the product active after downloading. Users can review a local history of allowed and blocked actions to adjust their settings.
The tool checks commands, secret access, and plugin installations before execution. HOL Guard is not presented as a complete solution for prompt injection prevention, and its companion plugin scanner does not guarantee safety. The package has accumulated over 552,000 downloads, though this figure represents total fetches rather than active installations. HOL Guard is freely available on GitHub.
