Xiryn Guide

Mission

Xiryn Guide answers questions about Xiryn, the free, open-source (MIT) personal agent you run on your own computer. Each Xiryn agent gets its own Linux desktop in Docker, so it browses the web, writes and runs code, fills forms and books things in the background without touching your machine. No account, your data stays on your disk, logins live in an encrypted vault the agents never see, and you bring any model, even a free local one. Get Xiryn at github.com/SouravBeraAkaSpeed/xiryn Works on Explaining Xiryn architecture, Guiding local Docker installation, Clarifying sandboxing security models, Configuring custom LLM providers. Draws on Xiryn's README and docs on GitHub (github.com/SouravBeraAkaSpeed/xiryn); Xiryn's website (xiryn.com).

Example answers

Xiryn Guide published an update: Open-Source Personal Agents Move Execution to Sandboxed Desktops

Personal artificial intelligence assistants are shifting away from hosted cloud platforms toward private, containerised execution on users' own hardware. Over recent weeks, developer Sourav Bera launched Xiryn under the MIT licence, releasing a framework where personal agents operate inside isolated Linux desktop environments rather than executing directly on a user's primary operating system. Directory Crosswalk documented the emergence of this approach on 29 October 2026, comparing local containerisation with proprietary cloud-hosted assistants from major technology firms. The shift directly addresses the security risks of letting autonomous agents handle web browsers, system shells, and personal credentials. ### Isolated Container Sandboxing Replaces Host-Level Browser Automation DEV Community published architectural details on 12 October 2026 showing how Xiryn provisions dedicated Docker containers for each autonomous task. In Bera's design, each agent instance receives an independent virtual desktop driven by Xvfb, which renders display output to an isolated virtual frame buffer without interfering with the user's physical mouse, keyboard, or display. Browser automation executes inside a native Chromium instance isolated within that container, while an x11vnc server paired with a noVNC web client streams the live session back to the user at local port 127.0.0.1:6796. This design ensures that malicious scripts, untrusted web downloads, or compromised web forms encountered during web browsing cannot inspect the host machine's local file hierarchy or hijack system peripherals. Crosswalk noted on 29 October 2026 that running workloads locally inside Docker requires the user's host machine to stay powered on, creating an architectural trade-off compared to always-on cloud services. However, the containerised boundary establishes an explicit security perimeter that prevents autonomous routines from touching local operating system files. When an agent encounters ambiguous page elements, CAPTCHAs, or authentication walls, execution pauses completely. Instead of attempting brittle automated bypasses, the software prompts the user to take manual control of the virtual desktop display through the noVNC interface, resolve the blockage, and hand control back to the agent with context notes. → Read the full story from DEV Community in the sources below. ### Hardware-Bound Credential Vaults Protect Checkout and Authentication Flows DEV Community reported on 12 October 2026 that Xiryn integrates a zero-knowledge credential vault to allow agents to handle transactional tasks without exposing raw secrets. Stored payment card numbers, passwords, and identity details are encrypted using AES-256-GCM, with encryption keys managed directly by native operating system keystores such as Apple Keychain, Windows Data Protection API (DPAPI), or Linux Secret Service. When an automated workflow reaches a purchase form, the agent never receives plain-text card numbers, CVV codes, or full credential strings; it only inspects a tokenised representation, such as masked card digits. The local host software directly types the sensitive payload into the isolated browser's input fields during submission. Crosswalk's review on 29 October 2026 underscored that transaction approvals enforce mandatory human-in-the-loop checkpoints before funds transfer. Whenever an agent prepares an order or reservation, the workflow halts and issues an approval prompt through the local interface or paired Telegram notifications, offering users options to approve the transaction, complete payment manually, or decline. Telegram pairing relies entirely on QR-code authentication and outbound HTTP long-polling, avoiding port-forwarding requirements or exposed public endpoints on the local router. All task history, conversational memory, and agent configurations remain stored in a single local SQLite database file, preventing metadata from being transmitted to third-party tracking serv