Violoop is a USB device that poses as a keyboard so an AI agent can click macOS permission dialogues software agents are blocked from touching.
What is Violoop? #
Violoop is a small hardware box that plugs into a Mac over USB-C and presents itself to the operating system as a keyboard and mouse. Inside, it runs an AI model that watches the screen, decides what to click or type, and sends those actions through a real physical keyboard chip rather than software-simulated input. That distinction matters because macOS treats software-simulated clicks and real keyboard input very differently, and that difference is the whole reason Violoop exists.
TL;DR #
- Violoop is a USB-connected hardware device that identifies to macOS as a physical keyboard and mouse, not as software, which lets it interact with the system in ways app-based AI agents cannot.
- Since Mojave in 2018 , macOS blocks software-generated clicks and keystrokes on security and privacy dialogues, which is why tools like Claude’s or OpenAI’s computer-use features can’t approve their own permission prompts.
- The device holds a physical confirmation key on a separate chip that isn’t wired to the AI model, so the model can propose irreversible actions like deleting files but can’t execute them without a human pressing that key.
- Users can choose the model backend , including Anthropic, OpenAI, Google, OpenRouter, or any OpenAI-compatible API, meaning it’s possible to run the “brain” entirely on local hardware for privacy.
- The creator demonstrated it clicking a real permission dialogue , waiting for human confirmation before deleting files, and building a self-scheduled monitoring task (a cron job) from a single spoken instruction.
- Violoop claims it discards screen frames after processing and keeps only small amounts of extracted text, but this claim was not independently verifiable at the time of testing.
- A version called V4 is set to launch on Kickstarter, described as quieter than the V3 beta unit used in testing, with plans to open source the firmware on the security chip.
Remy doesn't write the code. It manages the agents who do. #
Remy runs the project. The specialists do the work. You work with the PM, not the implementers.
How does Violoop get around macOS security restrictions? #
Desktop AI agents on the Mac typically work by requesting two permissions: screen recording, so the model can see what’s on screen, and accessibility access, so it can send simulated mouse clicks and keystrokes. That’s how tools built around Anthropic’s or OpenAI’s computer-use capabilities operate.
The problem is that macOS has specifically closed that loophole for security-sensitive moments. Starting with Mojave in 2018, Apple began discarding synthetic (software-generated) clicks and keystrokes when they’re aimed at system security or privacy dialogues. The logic is straightforward: if an app could click “Allow” on its own permission request, the permission system would be meaningless. OpenAI’s own documentation acknowledges that its computer-use tooling cannot authenticate an administrator or approve these prompts. Anthropic’s computer-use feature runs into the identical wall.
Violoop sidesteps this because, from macOS’s perspective, it isn’t software at all. It enumerates as a USB keyboard and mouse, the same class of device as any external keyboard. The system has no way to distinguish a keystroke coming from Violoop’s internal chip from one typed by a human finger. The AI model inside the box watches the screen, recognizes that a dialogue like “Terminal wants access to control Finder” has appeared, and directs the keyboard chip to press the right button, using real HID (human interface device) signals rather than simulated ones.
What can it actually do? #
In demonstrations, Violoop handled a few distinct categories of tasks. It approved a macOS permission dialogue remotely, something no purely software-based agent can do because of the Mojave-era restriction described above. It also carried out a file cleanup task, being told to delete everything older than a month in a given folder, correctly identifying which files matched that description.
It was also used to monitor a webpage (an Apple developer page for a beta software release) and set up recurring checks every few hours, entirely on its own, without the user writing a script or configuring a cron job by hand. The device translated a single natural-language instruction into a scheduled, repeating task and was set to send a notification once the target content appeared.
The device also builds a persistent memory of things it observes, such as work context or recurring topics, which the user can review or delete through a companion app. Every job it runs, including which model handled it and what it cost in tokens, is logged for review.
How does the safety mechanism work? #
The core safety feature is architectural, not just a setting. Violoop contains two chips. One runs the AI model that interprets the screen and figures out what actions to take. The other is the chip physically connected to the Mac as the keyboard, and it holds a dedicated confirmation key that is not wired into the AI at all.
Seven tools to build an app. Or just Remy. #
Editor, preview, AI agents, deploy — all in one tab. Nothing to install.
For reversible actions, like clicking “Allow” on a dialogue, the device acts immediately. For anything irreversible, deleting files, sending messages, publishing content, it stops and waits. The model can select which files to delete or what to send, but it cannot press the confirmation key itself. That decision stays with a human, either by pressing the physical key on the device or confirming through the companion app or an on-screen prompt. Violoop has stated it plans to open source the firmware running on that confirmation chip, which would let outside developers or security researchers verify that the AI genuinely has no path to triggering it.
Is Violoop just another version of Microsoft Recall? #
The comparison is understandable since both involve something continuously watching a screen, but the design goals are different. Microsoft’s Recall feature stores screenshots over time to build a searchable timeline a user can scroll back through, and it runs on the local machine’s own resources as an ongoing archive.
Violoop’s stated approach is to process screen frames on the device itself and discard them, retaining only small amounts of extracted text, on the order of a few megabytes, rather than a visual history. Because the processing happens on Violoop’s own hardware rather than the host Mac, it doesn’t compete for the computer’s CPU or memory regardless of whether that Mac is a high-end machine or an entry-level model.
The more meaningful difference, though, is that Recall is a memory tool. It records. Violoop acts. It can click, type, delete, and schedule tasks on your behalf, which is exactly why the confirmation-key safeguard exists in the first place. A passive memory tool doesn’t need a physical veto button. An agent that can delete your files does.
What are the limitations? #
Not everything advertised was working reliably in the tested unit. A proactive feature, where the device is supposed to notice a repeated manual task and offer to automate it going forward, did not trigger during testing. That capability was described as dependent on a software update still in progress.
It’s also worth being clear about what’s verifiable and what isn’t from outside testing. Direct observation confirmed the device can click a real permission dialogue and that it stops and waits for physical key confirmation before an irreversible action. Claims about frame data being processed and erased on-device, and never leaving the box, come from the maker and were not independently auditable without access to the firmware. That’s expected to become checkable once the firmware is open sourced.
Violoop also isn’t positioned as a general-purpose chatbot. It has chat capabilities, but its core function is executing tasks on a computer a user isn’t actively sitting at, not conversation.
Frequently Asked Questions #
What is Violoop used for?
It’s used for controlling a Mac remotely or hands-free, particularly for tasks that require approving system permission dialogues, cleaning up files, or setting up monitoring jobs like watching a webpage for changes, all through natural-language instructions rather than scripts.
Why can’t normal AI agents click macOS security dialogues?
Because macOS, since the 2018 Mojave release, discards software-simulated clicks and keystrokes aimed at security and privacy prompts specifically to prevent an app from approving its own permissions. This affects any agent using accessibility-based simulated input, including tools built on Anthropic’s or OpenAI’s computer-use features.
Does Violoop send my screen data to the cloud?
One coffee. One working app. #
You bring the idea. Remy manages the project.
It depends on configuration. The model backend is selectable, including local models run on hardware the user owns, in which case screen analysis and reasoning can happen without any third-party cloud service involved. If a cloud model like one from Anthropic or OpenAI is chosen instead, that provider is in the loop.
Can Violoop delete files or send messages without permission?
No. Irreversible actions require a human to press a dedicated confirmation key on a chip that isn’t connected to the AI model. The model can decide what it would delete or send, but it cannot authorize the action itself.
Is Violoop available now?
The version referenced for wider release, called V4, is described as launching via Kickstarter, with the tested unit being an earlier V3 beta version supplied ahead of that launch.