0.19.14-alpha

The agent can read documents now.

Until now it could see a photo and hear a voice message, but not read an invoice. Send it a PDF and it answered "Its content is not available to you" — honest, and useless.

read_document takes a path and returns text: PDF, Word, Excel, PowerPoint, plus plain text formats.

It is a read, and the kernel says so

The tool is a READ with a real target, exactly like see_image and hear. The kernel judges the path, so a payslip under ~/.secrets is refused without the reader knowing anything about it. Two adversarial cases hold that — including the counter-proof that an ordinary invoice stays readable.

Reading happens locally. A medical report has no business at a third-party service just to become text.

One dependency, not three

Only PDF needs a library (pypdf, loaded on first call). docx, xlsx and pptx are ZIP archives holding XML, and the standard library reads them.

Two attacks an office reader brings

Both are refused before anything is read:

• Zip bomb — 40 KB expands into gigabytes. The uncompressed size is taken from the archive index before a single byte is unpacked.
• XML entity — <!ENTITY xxe SYSTEM "file:///etc/shadow"> turns the parser into a file reader operating around the kernel: the file the kernel approved is the document, not what the parser pulls in afterwards. Any DOCTYPE or entity declaration is refused unread.

Document text reaches the model inside its own untrusted frame — data, never an instruction, even when phrased as one.

Verify this download

sha256  38785b734f11b8163a5413884d0b44f8953560fd4add69c56e5569c96494d229

The .sig is a raw Ed25519 signature over the archive bytes, base64-encoded. The public key is pinned in install.sh:

Do7lfPckC7pJJtD4BECN/mLPIOqHZVWm/j/MfJOK2hk=

Install

curl -fsSL https://talos-agent.ch/install.sh | sh

Suite: 2753 tests, 254 adversarial cases.