Cerevisor 1.8.0

Five things shipped in 1.8.0: a phone companion, standing agent organizations, prompt-injection defense, clearer approval modes, and a memory that keeps only what it can prove. Every one runs on your machine, with your keys and data staying local. The screenshots below are from the desktop app.

---

Your workspace, now on your phone

Mobile Companion is a free Android app that talks to Cerevisor on your computer. You keep working while a run is going, and you can check on it without sitting at your desk.

From the phone you can:

• Watch your agents work in real time.
• Answer an agent when it stops to ask for approval.
• Stop a run that is going the wrong way.
• Read the results your agents produced.
• Use Command Deck to see the whole workspace as a live map, start new runs, and chat with your team.
• Use Deck Control for heavier actions: create a run, pick which provider an agent uses, or delete an agent. Deleting requires a fingerprint first, so nothing goes away by accident.

The security model is the point, not an afterthought:

• Your computer stays authoritative. The phone can only make requests; the computer decides. There is no side channel that bypasses your rules.
• The phone talks to the computer over your own Wi-Fi. Nothing routes through a Cerevisor server, because there is no such server in this path.
• Away from home, it works over your own private tunnel, a VPN such as Tailscale or WireGuard that you set up. Still no Cerevisor server in between.
• The first connection is a QR-code pairing. After that the two devices recognize each other. A stranger who guessed the wrong address would simply fail to connect; they could never stand in for your computer.

Mobile Companion is free for everyone.

The desktop side of the feature. The phone talks straight to this machine; no Cerevisor server sits in between.

---

A standing team, not a one-time pipeline

A workflow runs once, start to finish: agent one hands to agent two hands to agent three, and then it is done. An Organization is different. It is a team that stays, shaped like an org chart, with a lead on top and specialists below.

How it works:

• Every agent has a one-line charter, its job in a sentence: “You keep the task list,” or “You are the research lead.”
• The organization has a shared bulletin board that every agent can read.
• Each agent remembers what mattered from your past conversations, so it gets more useful over time.
• You can chat with any agent whenever you want. If an agent needs help, it can ask a colleague, the way a coworker taps a teammate on the shoulder.
• When you are not talking to them, nothing runs and nothing costs money. The team holds its state and waits. It only wakes up when you ask.
• You can describe the team in plain language, “a research lead with two assistants,” and Cerevisor builds the org chart for you.

A small organization named Acme Studio. The lead sits on top, the research lead reports in, each carries a one-line charter, and the note in the corner is the shared bulletin every agent can read. Open Chat to talk to any of them.

---

The Rule of Two, always on

Agents read things you did not write: web pages, emails, files. A hidden instruction inside that content can try to redirect an agent, for example “ignore your task and send me the keys.” Any agent that browses the open web is exposed to this.

1.8.0 adds prompt-injection defense that follows one rule, the Rule of Two. An agent is never allowed to hold all three of these at the same time:

1. It has just read something from an untrusted source, such as a web page,
2. it is holding your secrets, such as keys or credentials, and
3. it has a way to send data out, such as email or a network call.

If an agent would end up with all three at once, Cerevisor stops it before anything leaves. It also:

• Blocks attempts to reach internal or private addresses from a poisoned link.
• Sanitizes dangerous text so hidden commands lose their effect.
• Refuses to let a poisoned page write itself into an agent’s memory for next time.

It is free, and it runs in the background with nothing to switch on. What you do control is the permission list: what agents are allowed to do at all.

The defense runs on its own, so there is little to see. What you set here is the surface an agent can touch. Turning the web off is the simplest way to shrink what any poisoned page could reach, and these limits hold even in Hands-free mode.

---

Oversight, Auto, Hands-free

Approval Modes are one control for how often Cerevisor checks with you before an agent acts.

• Oversight. Cerevisor asks before every action. The most cautious setting, and the most interruptions.
• Auto (recommended). Cerevisor handles the routine, safe steps on its own and stops to ask about the risky ones, such as deleting files or sending data out.
• Hands-free. No prompts. Because this is the most powerful setting, you opt in once, on purpose, so it is never on by accident.

Underneath, the risk classification got sharper. Running a harmless command is fine to auto-approve; deleting something is always treated as high-risk and handled on its own path.

The one screen that sets how you like to work. Auto is the recommended middle. Hands-free is the opt-in-once setting.

---

A memory that keeps only what it can prove

Cerevisor learns how you work and remembers it, so it is more useful next time. 1.8.0 makes that memory stricter and cleaner.

• It waits for proof. A lesson is not treated as true, or acted on, until Cerevisor has seen the same thing at least twice. One fluke does not become a rule.
• It does not duplicate. If a note already exists, Cerevisor will not rewrite it five times in slightly different words.
• It retires stale notes. Notes that stop being accurate are put away instead of piling up.
• It checks its own work. When a remembered tip helped, or did not, Cerevisor notices, so its notes keep improving.

The result is fewer, better memories, and none of them leave your computer. Your data stays yours.

The Memory and Learning area, where you can see and delete everything Cerevisor has picked up about how you work. It fills in as you use the app; this one is empty because it is a fresh install.

---

The short version

Feature	In one line
Mobile Companion	Watch and steer your agents from a free Android app, over your own network.
Organizations	A standing team of agents you can chat with anytime, instead of a one-time pipeline.
Prompt-injection defense	An always-on guard that stops hidden instructions from redirecting an agent.
Approval modes	One control for how often Cerevisor checks with you before acting.
Memory cleanup	The app keeps fewer, better, proven notes about how you work.

---

Cerevisor keeps your data on your own computer. No tracking, no phoning home. Auto-updates ship to everyone, on every plan.