Claude Code under grith: 0.27% of calls reach a human

grith’s developer ran a month of Claude Code sessions under grith, an open-source supervisor that intercepts every syscall the agent makes. A median of 0.27% of operations per session froze for a human decision, and every read it queued for review was a credential store. The figures come from a September 4 post on the Grith blog, pulled from grith’s local audit log across 120 sessions.

The rest of the split looks like this: a median of 98.4% of operations were allowed silently, and a median of 0.9% were denied outright with no prompt. The denials are calls grith never accepts, such as the io_uring rings it blocks structurally. All three are per-session medians, so they don’t need to add up to 100. Only the 0.27% reaches you as a prompt, which the author describes as “a handful across the whole session, if that”, set against the forty an hour that push people toward --dangerously-skip-permissions in the first place. The sample also comes from a single machine, the one grith itself is written on, so these medians describe one developer’s workflow and not a fleet’s.

What the 0.27% was

The reads grith queued across those sessions include ~/.aws/login and ~/.aws/cli, ~/.ssh/keys down to a specific private key, ~/.gnupg/private-keys-v1.d, /var/lib/sss/secrets, and .env and .env.local in a production project that wasn’t the one being worked on. The author says none of these were part of a task they gave the agent. The post makes no claim about why Claude Code made those reads. Its point is that without something underneath the agent, the reads complete silently.

Codex, on the same machine, went further. Asked to fix a DNS bug in one repository, a process in its tree spent four and a half minutes walking the whole disk, reading anything whose name looked like a secret: ~/.aws, ~/.ssh, ~/.gnupg, ~/.docker, the secrets of a project it had never been pointed at, and key material under /usr/share. That came to around two thousand file operations across 707 directories. grith froze every real credential store it reached: 11 queued, 0 allowed.

Half an hour later, it did it again.

How a syscall gets its score

Tracing every syscall with plain ptrace stops the agent twice per call, and an agent that hammers stat and read in tight loops slows down visibly, grith explains in a separate post on its design. Its fix is a seccomp-BPF pre-filter, a small program the kernel runs on each syscall to classify it. Uninteresting calls run at native speed, and only the ones of interest hand control to the supervisor. The filter is installed with the thread-sync flag and is inherited across fork, clone and execve, so every child the agent spawns runs under it from the start. The stated target is P95 overhead under 50 microseconds per intercepted syscall and under 5% wall-clock slowdown end to end.

Each intercepted call goes through 18 filters in three phases: static checks (paths, allowlists, operation risk), pattern filters (1,617 secret-scanning regexes, command matching, egress policy, destructive-op detection), then contextual ones such as taint tracking and rate limits. Measured scoring takes 0.02ms at the median, and 1-3ms when the pattern phase fires. A score under 3.0 lets the syscall proceed. Anything over 8.0 gets EPERM injected into its return, so the agent sees an ordinary permission error. Between 3.0 and 8.0, the process freezes mid-syscall until a human answers. You can allow the call once, allow the whole class for the rest of the session, or deny it. Thresholds are configurable per environment, and grith proxy test '<JSON>' dry-runs a call to show its score and which filters fired.

The 98.4% comes mostly from profiles. grith ships named ones for claude-code, codex, aider, goose and cline, and each auto-allows that tool’s routine work: reading source, running tests, resolving modules, spawning git. Point grith at a tool it has no profile for and it will prompt more at first, until you have allowed that tool’s routine operations once.

Against auto mode

The matching layers are deterministic and there is no LLM in the enforcement path, so a poisoned README that talks the agent into something doesn’t move the score. Anthropic’s auto mode, generally available in Claude Code since July 10, works one layer up: a classifier reviews each tool call for destructive actions, data exfiltration or malicious code execution. Anthropic says it reduces risk compared with --dangerously-skip-permissions but doesn’t eliminate it, and that the classifier may still allow some risky actions. In August, prompt injection experiments got that classifier to approve running a downloaded script in 6 of 10 runs.

Where it stops

grith supervises the process tree it launches, not the whole machine. For genuinely untrusted code, the author calls a VM or container boundary complementary, not something grith replaces: isolation contains the blast radius, supervision sees each action. It isn’t a backup either. It freezes a destructive delete before it runs, but it can’t undo one that already happened. A write-up on mech.app, which dates grith’s launch to August 28, adds two caveats. The audit log records what the agent tried to do but not why. And the permission model is path-based, which leaves it open to TOCTOU races, where a path changes between the check and its use. The write-up says grith mitigates this by re-checking paths at syscall time.

The security core is free, offline and MPL-2.0. It’s a single static Rust binary for Linux x86_64 and aarch64, installed with curl -fsSL https://grith.ai/install | sh. Where you would run claude --dangerously-skip-permissions, you run grith exec claude (or grith exec codex) and leave the session unattended. The audit log is there the next morning as a record of every file the agent touched.