This week, the AI community was shaken by a sophisticated supply chain attack on LiteLLM, a popular tool downloaded millions of times. A malicious software dependency was used to harvest credentials from developers' machines. Despite having SOC2 and ISO 27001 certifications, the project was compromised from within.
This incident is a wake-up call. It proves that certifications are not immunity. At WOS, we didn't wait for a breach to design our defense. We built WOS with a "Trustless" architecture that assumes supply chains will fail.
The Vector: Exfiltration
The LiteLLM attack worked because the malware could "phone home." Once it stole a credential, it had the network permissions needed to send that data to a remote server. In modern software, we often grant apps total network freedom by default. This is a massive mistake for any tool that touches your sensitive environment.
The WOS Defense: macOS Seatbelt (SBPL)
WOS is isolated from the internet using macOS Seatbelt (SBPL). This is the same low-level kernel technology that protects the core of macOS. We don't rely on the high-level, often bypassable App Sandbox UI; instead, we inject a custom Sandbox Profile directly into the XNU Kernel at launch.
(deny default)
;; 1. DENY: The Blackout Rule
(deny network*)
;; 2. ALLOW: Minimal System Ops
(allow appleevent-send)
(allow file-read*)
This is a "Kernel Jail." Once WOS starts, the OS kernel itself enforces a Network Blackout. Even if a library were compromised, the malware is trapped in a zero-network environment. It cannot contact a server. It cannot upload your data. It is neutered at the physical hardware level.
Zero Dynamic Dependencies
Most AI tools pull hundreds of packages from NPM or PIP during build time. One compromised account on an obscure utility library can poison the entire well.
WOS has Zero Remote Dependencies. Every line of code used to build WOS is stored within our audited repository. We do not pull remote Swift Packages or NPM modules. By "vendoring" our source code, we break the automatic update chain that hackers exploit.
Key Scoping: Only the Essentials
While WOS requires Accessibility permissions to facilitate window switching, our low-level C-filter ensures we only "hear" what we need. When you type your password or a sensitive email, the WOS event tap sees those keys and immediately discards them at the kernel interface before they ever reach our main application logic.
Conclusion: Enforcement over Compliance
LiteLLM displayed security badges while the infection spread. At WOS, we believe security should reside in the kernel profile and the architecture, not just the footer of a website.
For power users who live in their browsers and terminals, WOS provides a switching experience that is as safe as it is fast. No networks. No remote code. Pure, local flow.