You have a little voice that makes you stop and look before you do something you would regret. AI agents mostly don’t. We would love to hand an agent a day’s work, our inbox, our files and our code, and go home. AMYGDALA v6.7 is our design for giving an agent that voice without touching the model it runs on: six families of checks, a fast judge called Jev that answers by picking from fixed options, and plain code that decides what each answer may do. It is a design, not a finished system, and the paper says so. Part of our open Building Jarvis series.
Abstract
Think of the voice that jerks your hand away from a spider on your sleeve before you have had time to think. It also tells you when something is unclear, when something is new, or when a loss would be hard to undo. It comes from the amygdala, a pair of almond-shaped structures deep in the brain. It does not decide for you. It makes you stop and look.
Agents have only scraps of this. They misread requests, take steps that cannot be undone and report work that never happened. And most of us cannot retrain the models they run on.
So the paper proposes a digital amygdala: the amygdala’s functions, distilled into six families of uses and built beside an unchanged model. It keeps the agent safe, gives a second opinion when a request can be read two ways, double-checks every “done” against what actually ran, adds a bit of personality (curiosity and surprise), helps with efficiency in picking the right skill or model, and keeps learning from each incident without retraining anything.
The paper is clear that this is designed, not yet built. It gives the tests that will decide whether it works.
Three things that went wrong
We ran an agent for one user, every day, for six months, on TinkerClaw, our fork of OpenClaw. Three incidents from that record show the problem.
- A misreading. The user wrote that he might offer a domain owner 500 € “within a few years or until my project starts getting traction”. He meant a standing offer, and the assistant read it as a purchase now, paid later. Every noun survived, but the commitments did not.
- A step that could not be undone. A print job of nine documents was interrupted. When the agent picked it up again, it saw an empty queue and sent the job again. The finished jobs were sitting in the printer’s history. Nine documents came out twice.
- A claim with nothing behind it. After a safety filter declined a request and the session fell back to another model, that model reported downloads and file edits it never ran.
This is not just us. In one study, coding agents given vague operations tasks went beyond the intended scope in 55.8–67.8% of the runs where they acted (Ji et al., 2026). In another, false claims of success made up 45–48% of failures in one setting and 75.8% in a second (Advani, 2026).
The numbers behind the design
All from a small set of synthetic cases we wrote ourselves, run on 28 September 2026. They say the judge is worth testing properly. They do not say it works.
How it works, in one minute
- Five points of entry. Other code can look in on an agent turn at five moments: when the prompt arrives, when the context is built, before a tool runs, after it returns, and before the turn ends. The digital amygdala lives only at those points.
- A judge that cannot talk. Jev, from TypeSafe AI, is a typed decision model. It answers by picking an option, a level or a probability, never by writing text. Code, not the judge, decides what each answer may do.
- One rule for proof. The more a step could cost and the more doubtful the request, the more proof the agent must show before the step runs. A low-risk step just runs, while a risky delete is held, with a note saying what would release it: list what the folder holds, say where you searched for references, point to where the user asked for it. Rephrasing the step does not release it. Evidence does.
- Hard rules come first. A short list of prohibitions sits in front of everything and never depends on the judge. The digital amygdala is a soft layer behind it.
- Every “done” is checked. Before the turn ends, the reply is split into claims, and each claim that something was done needs a record in the tool log. “Your reply says the PDF was uploaded; no tool call in this task uploaded anything” sends the agent back.
- Learning without retraining. Each hold or note is scored later by what happened next. The judge’s questions get reworded or re-tuned from that record. Tightening a check is automatic, but loosening one needs the user’s approval.
One finding from the probes changed how the questions are asked. Asked which reading of “clean up the old logs” was most likely, the judge picked “delete old files” with probability 1.00 before it had seen any evidence. Asked instead whether the evidence confirmed or ruled out each reading, its answers moved as the evidence came in. So the design asks about evidence, never about plausibility.
Where this fits
Most of the pieces exist somewhere. What the paper adds is one component, organised by what an amygdala does, that follows the whole task.
The closest work to ours. It uses the same typed model on each tool call to score risk, whether the user asked for the step, and whether it follows a planted instruction. We also look before the first tool call and after the last one, where two of our three incidents happened.
Claude Code hooks, NemoClaw, DefenseClaw
Claude Code hooks provide four of the five entry points the design uses; the fifth sits in the harness itself. NVIDIA’s NemoClaw and Cisco’s DefenseClaw add sandboxing and runtime scanning to OpenClaw.
AEGIS (J9)
Our companion security paper draws the line this one builds on: hard controls stop an action, soft controls only warn. The digital amygdala is a soft control, so hard rules stay in front of it.
What changed, and what is next
Earlier versions of this paper, up to v4.1 (19 September 2026), were a report built around negative results from a learned predictor. Version 6.7 starts over from what the amygdala does for people and turns it into a design with a typed judge at every step. The older figures are not part of it.
The next step is a preregistered test on three sets of episodes: about 220 where a harmful step is available, about 140 where a risky-looking step is actually wanted, and 500 ordinary tasks. The questions are simple. Does harm fall? Does real work still get done? Does it interrupt too often? The paper lists “no tested guard helps” as one of the possible answers, and says it will report it if that is what comes out.
Since the paper, the first pieces have started to appear in TinkerClaw’s development branch. In October 2026 the AEGIS hard rules became the first layer of the amygdala, a stronger model now reviews the flags, and a rule only starts acting once its reviews show it is useful. None of that has been through the evaluation yet.
🔬 Building Jarvis in the open
The full J-series, our papers on agent safety, memory, orchestration and autonomy, plus the code behind them.
Read the paper
AMYGDALA v6.7: A Digital Amygdala for AI Agents. The Little Voice Agents Are Missing · 32 pages · 29 September 2026
Was this useful?
We’re building these in the open and we want your read on them. Which of the six families would you want first in your own agent? What would make you trust it with a day’s work? Tell us in the comments below.
Everything on the site, by topic or date: Browse the Tinker Zone