Antivirus for AI agents: what actually protects your machine

An AI coding agent runs with your rights. It can read your .env, your SSH keys and your shell history, and run commands. Nothing "malicious" has to be installed for that to go wrong. This page explains why signature antivirus does not cover that, what does, and how to check your own machine in three minutes.

   YOU                         YOUR AI AGENT                 ANYONE WHO TALKS TO IT
  ┌─────┐   same rights    ┌────────────────┐   instructions   ┌────────────┐
  │ ◉ ◉ │ ───────────────▶ │  reads  .env   │ ◀─────────────── │  web page  │
  │  ▽  │                  │  reads  ~/.ssh │                  │  issue     │
  └─────┘                  │  runs  commands│                  │  README    │
                           └───────┬────────┘                  └────────────┘
                                   │
                          what it can reach is
                          what a hijack can take

Why a normal antivirus is the wrong tool for this

A classic antivirus compares files and behaviour against known malware. That works when something foreign runs on the machine. With an AI agent the situation is different: the program is legitimate, it is signed, it was installed on purpose, and it acts with your user rights. The risk is not a virus. The risk is what the agent can reach and what can talk it into using it.

That is the reasoning behind the product, not a measured detection statistic: if the dangerous thing is a secret lying in a readable file, the useful check is "which secrets lie where, and who can read them", not "does this binary match a signature".

This is not theory. In August 2025 the s1ngularity attack on the Nx build tool shipped malware that looked for installed AI command-line assistants and told them to search the victim's file system for credentials, SSH keys and wallets. Weeks later the self-spreading Shai-Hulud npm worm hunted for publishing tokens. Both worked because the secrets were sitting where any process of the user could read them.

What Dante is

Dante is a free, open command-line watchman for machines you own: your Mac, Linux or Windows computer, and servers you can reach by SSH. You talk to it in plain German, English or Spanish. It reads, it explains, and it changes nothing without a clear yes.

• Every verdict carries the real line it came from. If Dante cannot read the proof, the verdict is unknown. It never says safe on an assumption.
• Silent by default. No telemetry, no background update check, no account. The free state runs fully offline.
• Zero dependencies. One small Node.js program you can read. The source is public.

user ❯ check my computer

  SAFE   Openly readable secrets in the web directory
  what: No openly readable .env/.sql/.git files in the web root.
  proof:
    • Web root searched, nothing readable found
      ↳ dante:find-files /var/www (.env, *.sql, …)  →  (no matches in: /var/www)

  UNKNOWN   SSH: root login and password login
  what: No SSH service listens on port 22 here; I do not know whether the settings matter.
  proof:
    • PermitRootLogin = (not set)
      ↳ /etc/ssh/sshd_config  →  PermitRootLogin default

What it checks

• Secrets lying around: API keys, tokens and private keys in project files, .env files and Git history, matched against a library of 1,111 secret formats. It shows file, line and kind - never the value.
• Your servers: SSH settings, world-writable files in web folders, known PHP vulnerabilities by version, signs of web shells.
• AI agent configuration: MCP server entries and agent settings (with the optional Hugging Face analysis pack), reported without ever printing a key.
• Bait files (the "Wachschutz"): fake credentials that mail you the moment someone uses them.
• Windows: services anyone can overwrite, unquoted service paths, writable PATH folders, AlwaysInstallElevated, stored autologon passwords.

Is it any good? An honest answer

Dante is young. It is a watchman, not a real-time engine: it looks when you ask or on the schedule you agreed to, and it does not scan running processes for malware. What it does well is the boring, high-value part: finding the secrets and settings an attacker or a hijacked agent would use first, and refusing to claim more than it can prove. Its language layer (what you type) is trained on about 259,000 labelled sentences and answers "I don't know" instead of guessing when unsure.

Four steps, each one small

  STEP 1  LOOK        ████████████████████  free · 3 minutes · reads only
  STEP 2  DIG DEEP    ██████████████░░░░░░  secrets in your project folders
  STEP 3  BAIT        █████████░░░░░░░░░░░  a fake key that rings when it is used
  STEP 4  STAY SHARP  ████░░░░░░░░░░░░░░░░  fresh knowledge packs for new attacks

You never have to decide everything now. Start with step 1. Dante asks before every next thing, and every question shows the exact command first.

Start in three minutes

Install Node.js (nodejs.org, once), open a terminal, paste one line:

you@MacBook ~ % npx dante-watch

  I am Dante. I walk through hell and bring back the map.

  ● awake · I watch over localhost.

user ❯ check my computer

PS C:\Users\you> npx dante-watch

  I am Dante. I walk through hell and bring back the map.

  ● awake · I watch over localhost.

user ❯ check my computer

Same program, same words, on every system. Not sure where your terminal is? The install page shows it for Mac, Windows and Linux, step by step.

Details for every system, the free and paid parts and what each costs are on the install page.

Before you close this tab

Look, nobody wakes up wanting to audit their laptop. It is boring, it feels like homework, and it always looks fine until the day it does not.

So here is the deal. It takes three minutes. It only reads. It costs nothing. If it finds nothing, you wasted three minutes and you can say you checked. If it finds a key lying around, you found it before somebody else did.

Your agent has the keys to your house either way. The only question is whether you know which keys.

npx dante-watchCopy

Questions people ask