Charon

Not every soul is meant to cross.

0x5efe15C1783a5fE04ED289f3760e03afe3d6BbA3

[Charon @Charon_AI]

$CHARON is live on @bankrbot

CA: 0x5efe15c1783a5fe04ed289f3760e03afe3d6bba3

we put a ton of effort into shipping the MVP and have been building for the last two weeks.

for the MVP, we integrated codex since it runs locally.

next is @aeonframework, which runs on github actions and needs an aeon-native hook/adapter.

we are already in contact with @aaronjmars.

we launched the token on bankr to support development, inference costs, and bring more attention to what we are building.

[Charon @Charon_AI]

https://t.co/cMQb8ycSaf

[Charon @Charon_AI]

@aeonframework 🕵️⭐️

[Charon @Charon_AI]

$CHARON skill pack is now live on @aeonframework.

it ships two skills:

- `charon-setup` installs and verifies enforcement
- `charon-policy` lets users manage policy through natural language

install the pack, define your policy or keep the default, and keep using AEON normally.

PASS → continue
PAUSE → ask for approval
DENY → stop before launch

→ https://t.co/a0KWzgTYGn

thanks @aaronjmars for merging 🫡

[Charon @Charon_AI]

B20 Console ⏳

Tomorrow.

[Charon @Charon_AI]

looking into b20 rn.

base is shipping tokens with a much richer control surface than normal erc20s, and most people will not know what they are actually touching.

might build something for that.

[Charon @Charon_AI]

@alkuap soon

[Charon @Charon_AI]

B20

[Charon @Charon_AI]

@cybercelos @aeonframework hey, thinking of integrating it 👀

[Charon @Charon_AI]

Everything that can be breached will be breached we are in control the blast radius stage now. We cannot stop penetration, but can prevent sensitive actions from happening in case your agent gets hacked.

[ATBASH @ATBASHai]

Everything that can be breached will be breached we are in control the blast radius stage now. We cannot stop penetration, but can prevent sensitive actions from happening in case your agent gets hacked.

[Charon @Charon_AI]

@igoryuzo gm 🙌
https://t.co/eeWg4zRvXX

[Charon @Charon_AI]

https://t.co/W0qk9w53gB

[Charon @Charon_AI]

@aeoncityhub @aeonframework thanks for highlighting us!

[Charon @Charon_AI]

Major tech companies are working on agent policy enforcement, but most implementations are still inaccessible to everyday users 👇

- @Microsoft
https://t.co/xRmB9mKEoh

- @awscloud
https://t.co/nJo3LNX2Gt

- @googlecloud
https://t.co/r4uexxgMGV

We also love what @ATBASHai is building, although it is not publicly available yet.

[Charon @Charon_AI]

$CHARON is a firewall for AI agents.

Security and privacy were optional in the early internet. Everyone thought they were unnecessary until something broke.

The same pattern is repeating with AI.

We are giving agents access to code, files, wallets, APIs, browsers, and production systems. Some users do not even know what their agents execute behind the scenes.

We call this autonomy: an agent executing human intent.

But what happens when it does the opposite?

A bad prompt, malicious context, or simple misunderstanding can leak secrets, delete files, publish code, move assets, or trigger irreversible actions.

Prompts cannot enforce prompts.

Charon checks actions before execution:

agent action → policy → PASS / PAUSE / DENY → execution → receipt

This architecture has been researched across major security and cloud teams. Until now, implementing it required experienced security engineers and custom infrastructure.

Our first priority is enforcement.

Our second is making that enforcement accessible to everyone.

Security should be invisible, not annoying.

Install the Charon skills, define a policy with your agent or keep the default, and continue using your agent normally.

(Figure: @Microsoft Security Blog)

[@aaronjmars @aaronjmars]

this is really cool 🤝

fleet watcher is (the already existing) self-hosted ALLOW/BLOCK gate wired into @aeonframework actions: before each skill run it asks your control plane "is this allowed?" - BLOCK means Claude never runs (and it fails closed if unreachable), then a postflight step logs the outcome for taint analysis. you define red lines centrally in its dashboard (per-skill caps, allowlists, dangerous-string patterns), making it good for governing many instances at once.

@Charon_AI built a cool additive solution that adds a local policy layer at the same chokepoint: policy lives in the repo (charon.aeon.yml) instead of a hosted server, and it introduces a middle verdict - PASS / PAUSE / DENY - where PAUSE routes to Telegram for human approval instead of a hard allow/block.

so fleet watcher gives you centralized external red lines across the fleet, while charon gives you repo-local, reviewable rules with a human-in-the-loop step and signed receipts.

[Charon @Charon_AI]

@aaronjmars big

[Charon @Charon_AI]

https://t.co/W0qk9w53gB

[Charon @Charon_AI]

@aeonframework thank you!

[Charon @Charon_AI]

@aaronjmars @aeonframework thanks for the shoutout! 🙌

[@aaronjmars @aaronjmars]

this is really cool 🤝

fleet watcher is (the already existing) self-hosted ALLOW/BLOCK gate wired into @aeonframework actions: before each skill run it asks your control plane "is this allowed?" - BLOCK means Claude never runs (and it fails closed if unreachable), then a postflight step logs the outcome for taint analysis. you define red lines centrally in its dashboard (per-skill caps, allowlists, dangerous-string patterns), making it good for governing many instances at once.

@Charon_AI built a cool additive solution that adds a local policy layer at the same chokepoint: policy lives in the repo (charon.aeon.yml) instead of a hosted server, and it introduces a middle verdict - PASS / PAUSE / DENY - where PAUSE routes to Telegram for human approval instead of a hard allow/block.

so fleet watcher gives you centralized external red lines across the fleet, while charon gives you repo-local, reviewable rules with a human-in-the-loop step and signed receipts.

[Charon @Charon_AI]

Today.

[Charon @Charon_AI]

@aaronjmars @aeonframework few

[Charon @Charon_AI]

We are actively testing Charon inside @aeonframework's GitHub Actions workflow.

Here’s what we shipped yesterday 👇

- Charon preflight for AEON workflows
- policy-based PASS / PAUSE / DENY before the agent run starts
- signed receipts for every AEON preflight decision
- review queue for paused actions
- GitHub Actions summary export for reviewable runs
- TG decision bridge groundwork
- public AEON test repo with real PASS / PAUSE / DENY runs: https://t.co/dsK7yhhFtx (watch us testing live)

Charon turns the AEON workflow trigger into a typed action before Claude starts: skill, input, actor, repo, trigger, and run id go into policy; the workflow only continues if the verdict is PASS.

Next, we’re wiring TG notifications:

- DENY → user gets notified that the task was blocked
- PAUSE → user gets an approval request before execution continues

It’s coming sooner than you think.

[Charon @Charon_AI]

We tested @base MCP with an unlimited USDC Permit2 approval request.

The request never reached Base Account.

Interlock: an MCP control plane for runtime enforcement.

🧵