vortex — safeguarding the agentic era

Waiting for you0:48

forum.example
your account · one session

whoclaude-code on laptop whatread and publish, once how long15 minutes, then out forrelease note

THE AGENT SAYS“I want to publish the release note and check the replies.”

Deny

Hold to allow0:41

signingthis request only keystays in this phone deviceSM-F971B

Keep holding…

Access opensigned

14:58 left on this grant

open forclaude-code mayread · publish may notchange the password

End now

Live12:06

14:58signed in as you@forum.example

14:54read 3 topics

14:31published “0.2 is out”

14:28read 1 reply

what the server could read 7F2A9C14 ··

End now

Access ended00:00

Broker access ended12:07 · nothing can be requested on this grant againconfirmed

Provider logoutforum.example did not confirm the sign-outnot confirmed

What staysthe post you published. Ending access does not undo work.

Back to home

01

An agent asks

Your phone buzzes. The request says which account the agent wants, what it intends to do with it, how long it needs and why. Nothing happens until you answer.

02

You allow, once

Your fingerprint signs that exact request: this account, this purpose, this long. The key doing the signing was made on the phone and stays there. The next request will ask for your fingerprint again.

03

It opens, with the clock already running

The agent gets a session on your account. Your password is not part of it. The deadline starts the moment you allow it, and nothing the agent does can move it.

04

You can watch it work

Reads and writes appear on the phone as they happen. If you do not like what you are reading, one tap ends the session there and then, and the agent loses access mid-sentence.

05

It ends, and the receipt says how

vortex closes its own side, then asks the site to sign you out. Those are two different facts, so the receipt keeps them on two lines: what vortex did, and whether the site confirmed it.

The blind path

The session runs on your phone. The server holds a block it cannot open. proven

Most brokers hold your secrets on their own server while they work for you. On the blind path the server has nothing to hold: the handshake happens on your phone, and the relay forwards sealed bytes it has no key for. The agent needs no vortex software at all. An ordinary TLS client on port 443 is enough.

agent relay your phone the site

what the relay can read 7F2A9C14 8B01 ···· Sealed bytes it forwards. The TLS handshake happened on your phone.

No vortex on the agent

Your agent talks ordinary HTTPS to an ordinary address. There is no SDK to install, no plugin, and no hosted browser anyone has to keep compatible.

No cookie jar to steal

There is no long-lived browser session sitting on a server waiting to be borrowed. The session exists while the grant does.

Your infrastructure

Run the relay yourself, or use the hosted one in the Netherlands. The source is open to read either way.

Hosted is still there

Not every site can be reached blind. When vortex has to do the work itself, the approval screen says so before you allow it.

Closing

“Closed” is two facts, and they stay two facts. working

A green tick is easy to draw. The harder question is what the other side did, and usually nobody went and looked. vortex reports the two separately, and it names the one that failed.

Session receipt · 12:07

Broker access endednew requests refused, the open stream cut mid-answerconfirmed

Provider logoutforum.example: logout not confirmed by the servicenot confirmed

What this does not claimwork the agent already did stays done, and anything it created elsewhere is not ours to revoke

verified

The site accepted the sign-out and we saw it take effect.

unsupported

The site offers no way to confirm it, so nothing is claimed.

unverified

We asked, and no confirmation came back. This is the line to read.

Heartbeat

Lose the connection and access closes on its own within 90 seconds. The lease is never extended past your deadline.

And your phone audits the record working

Every request, grant, teardown and rotation lands in a ledger. On the floor your phone keeps its own copy and compares the two. If the server's history ever disagrees with the phone's, the phone says so, which is what stops an operator quietly editing the past.

Every day, not just for agents

It is your password manager first. working

The entry you type into by hand is the same one an agent may borrow: one password, one history, one recovery. There is no second store sitting next to it for the robots.

Fills like a password manager

you@forum.examplevortex

••••••••••••vortex

Chrome and Firefox on desktop, Chrome and Firefox on Android, and Android's own Credential Manager. Exact origin only, never a lookalike domain.

Codes are generated on your phone

418 203

Two-factor codes never touch the server. If someone took the server tomorrow, the codes would still only exist on your phone.

One entry, two ways out

You get the password. The agent gets a connection. Same account, same history, two very different amounts of trust.

When the server is away, you are not locked out working

saved copy · offlinefills

Your phone keeps a labelled copy and goes on filling your logins. Edits queue up and are reconciled when the workspace comes back. Agent grants are the exception: those do need the relay.

Losing a device is a procedure, not a disaster working

Every save writes a recovery copy beside the real one, and the key to that copy lives inside your vault rather than on the server. An offline kit brings your accounts back onto a new phone.

You can take it with you in build

vault-2026-10-03.vxbencrypted

Encrypted export and import work today, passkeys included. A plain file you could hand to another password manager does not exist yet.

One approval model

The same fingerprint opens a website and a server. in build

A login and a shell ask the same question: who, what, how long. So they get the same screen, the same deadline and the same receipt, instead of a second tool with its own idea of access.

A website account

forum.example15 min

Read and publish as you, through the agent's own client. The password is never handed over.

A shell on your server

$ deploy-bot@server5› rolling out vortex-relay…› 14:12 remaining

An identity login is optional; your fingerprint is not. Cutting the connection says plainly what it does not undo.

Changing a password

The one job a password manager must never half-finish. in build

Write the new password down before the site changes, prove a fresh login with it, then promote it. If the result comes back ambiguous, both passwords are kept and the screen tells you so.

staged•••••••••• kept until verified••••••••

No two unresolved changes at once, no silent overwrite of a password that still works, and a verification login that has to actually succeed.

Rotating on a schedule, by default in build

The safe mechanism is finished. The timer on top of it is not. The goal is that a new account starts rotating on a schedule you never have to think about, and today it does not.

Generating the password in the first place in build

A generator belongs on the same screen as the change. Inventing a password is the easy half; the half that breaks accounts is promoting it before the site has accepted it.

How it is built

Six choices, in words you can check.

Hover a line for the name a cryptographer would use for it.

Your master password is made deliberately slow to guess.ARGON2ID64 MiB of memory and three passes per attempt, so a stolen copy is expensive to attack rather than quick.

Everything is sealed before it leaves your device.XCHACHA20·POLY1305The server stores a block it has no key for, and would notice if someone changed a byte of it.

Every entry has its own key.1 KEY PER ITEMOne leaked item cannot be used to open the next one.

Two-factor codes are made on your phone, never on the server.RFC 6238The shared secret stays in the vault on your device; the server never sees a code or the seed behind it.

The connection already mixes in a post-quantum key exchange.X25519MLKEM768Key exchange only. It is not a claim that signatures or stored data are quantum-safe.

The code that touches bytes from strangers is written in Rust.RUST · 4 CRATESThe session isolate, the broker helper and the phone's own session code. The control plane is Node: a managed runtime, so memory-safe too, but that does not make the whole thing Rust.

Not finished

What vortex cannot do yet — published, with the measurement.

A security product that lists only its wins leaves you to guess the rest. This is the other half, set in the same type size as the good news.

Open · measured

A site can still tell an agent from a browser

A provider should not be able to see whether it is you or your agent on the line. By default it still can, and the reason is a choice rather than a gap. The released binary was measured on the wire on 4 October: it opens every connection with our own memory-safe stack, which does not look like Chrome. Only when a provider refuses that handshake does it reach for the Chrome one — and then the cipher list, the groups, the signature algorithms and ALPN are Chrome's, field for field. So a site that never refuses us never sees the Chrome handshake, and a site matching on JA4 can still separate us on the first packet.

clientJA4ALPN

Chrome 1179t13i1515h2_888d5ea4525f_3b23ffcd8cech2

Firefox 1487t13i1716h2_f93452f633fd_d2d832bfac84h2

vortex, by defaultt13d1011h2_e5d1ce399c50_c7a156b1be61h2

vortex, after a refusalt13d1516h2_888d5ea4525f_3b23ffcd8cech2

Open

Passwords do not rotate on their own yet

The key your vault is encrypted under does: every ninety days, by itself, with no setting to find or forget. Your passwords are the half that does not. Changing one safely works; doing it on a timer against an outside provider needs a connector for that site, and only three exist. Everywhere else a password stays what it is until you change it.

Closed · measured

Leaving is as easy as arriving

One file, the format every other password manager imports, with a line to tick first that says in plain words it is readable by anything that opens it. Encrypted backups come and go freely beside it. Nothing here holds you.

Limit

Ending access does not undo work

A post stays posted and a file stays written. A credential the agent created somewhere else is not ours to revoke. Every receipt says so in those words.

Status

This is a validation build

Android and mobile web today, with iOS deferred. Broad website compatibility is not claimed: an agent can only use a site vortex already has a reviewed description of.

Safeguarding the agentic era