The AI That Lives Outside Your Computer: How Violoop’s HDMI Box Breaks the Permission Wall

Set up a desktop AI agent on a Mac and you hit the same wall every time: Terminal asks to control Finder, an Allow button appears, and the software agent — ChatGPT, Claude, it does not matter — cannot press it. Since Mojave in 2018, macOS silently discards synthetic mouse and keyboard events when they target security or privacy dialogs; if a program could approve its own permission prompt, the prompt would be pointless. In Alex Ziskind’s demo the desktop agents stall for exactly that reason, and even OpenAI’s own docs note that computer-use cannot authenticate an administrator or approve those privacy prompts.

A 90-millimetre box that watches over HDMI and types over USB

Violoop flips the approach: instead of installing software on the PC, you add a small box next to it. One USB-C carries data and video, with optional separate HDMI, and the host sees nothing fancier than a keyboard and mouse — enumerated like a wireless dongle. Under the hood a screen-reading flow watches the display, figures out what the open app is asking, and types and clicks back over USB. Think of it as a KVM with an understanding layer on top, turning remote hand-pressing into on-device interpretation.

Two chips, two jobs: one to see, one to hold

Inside are two distinct pieces of silicon. The first, built around an RK3576 with a dedicated accelerator, runs a local 8-billion-parameter model at 26 TOPS to read screen frames; reporting says processing happens on the box, frames are discarded, and only a few megabytes of textual context remain. The second is the only part wired to the Mac: an STM32H563 security microcontroller that owns the USB HID keyboard and the physical approval key on top. BVIO says it will open-source the firmware for that second chip; what was demonstrably true in the video is narrower — the model can select files to delete all day, but the flow halts until a human presses that key, because the key is not wired to the model.

Pick your brain: DeepSeek local, Claude in the cloud

Violoop’s app is mostly a brain router. Anything that speaks the OpenAI-compatible API can be plugged in: Anthropic, OpenAI, Google, OpenRouter, bring-your-own key, custom models. Ziskind points his at DeepSeek V4 Flash running on his own hardware, so screen reading stays on the box while reasoning stays on machines he owns and no third party is in the loop unless he adds one. Jobs can be split by cost and difficulty: the memory graph that connects work, people and screen observations can run on a cheap local model, while the hardest tasks are routed to a frontier model. Everything is tracked — which model ran where, how many tokens were spent and what it cost — and he advises setting a daily cap when using cloud keys.

The first live demo makes the permission breakthrough tangible. The same Finder dialog that stops software agents reappears, and a small blue Violoop cursor darts to the Allow button and clicks it while Ziskind holds his hands up to camera. A Rubber Ducky is also a keyboard, a KVM-over-IP box is also a keyboard, and both can press remote buttons if you drive them by hand; what is new here is the interpretation layer that reads the screen, decides which button the prompt means, and presses the right one without remote hands.

The key that stops the irreversible

The second demo crosses into irreversible territory. Asked to delete everything in an open Finder folder older than a month, the agent recognizes the GitHub repository in the window, chooses the candidates, and then stops. Deleting sits on the list of actions Violoop will not perform without a human. To proceed you press the physical key on top — reachable from the app or the touchscreen but semantically owned by the separate chip that holds the keyboard. The AI decides what to delete; you decide whether to delete, and the model cannot press that key itself no matter how strongly it wants to.

A cron in one sentence: watching the Xcode beta

The same approval pattern extends to a web watch. After visiting Apple Park for the iPhone Duo launch, Ziskind wants Xcode 27.1 beta the moment it becomes downloadable and asks the agent in one sentence: watch this page and ping me instantly when the developer beta becomes available. No script, no manual cron, no API. The agent builds the job, schedules it roughly every six hours, and surfaces it in the to-do list on the device and in the app where it can be toggled and inspected. At recording time the beta had not landed, but the intention is that the phone buzzes when it does, turning manual refresh into delegated watching.

Day-to-day texture fills in the gaps. Some status flows through the Dynamic Island and can be turned off or detached, memory accumulates as a graph of concepts with inspect-and-delete controls, and an audit trail keeps token and cost accounting. Hardware reality also intrudes: the tested unit is a V3 beta and fans are audible under load, while the editor note says the incoming V4 is quiet. On the verifiability question Ziskind is explicit — he personally saw the permission click and the halt-before-delete, but he could not independently audit the claim that frames are processed on the box and erased without leaving the device; that part remains the company’s word until the firmware is public and others can test it.

The Recall comparison and why it matters

The most common analogy is Microsoft Recall, and the difference as described is architectural. Recall keeps screenshots to build a scrollable history and runs on the host’s resources. Violoop, by its account, throws frames away, keeps only a few megabytes of text, runs the heavy work on the device, and acts rather than just remembers — which is why it needs a key. Whether that design delivers in practice — how much is kept, how quickly frames are erased, how isolated the box really is — is hard to verify from a single hands-on without source access, so a cautious reading separates demonstrated behavior from stated architecture.

The closing frame is about fit and missing pieces. If you need a hand on a machine you are not sitting at — pressing a permission prompt from another room, pruning files, or babysitting a release page — this hardware does something software agents on the Mac cannot otherwise do; if you are after a smarter chatbot, it is not the product, even though chat exists on top. The proactive suggestion feature, which is supposed to watch you repeat a task and offer to take it over, never triggered in testing, not once; BVIO says it is in updated software. The video is sponsored and the loaned unit is a V3, while what ships is the V4 that went live on Kickstarter on September 15 — early-bird 399 dollars versus a 699 retail reference — and funding coverage notes seed rounds in the tens of millions of yuan behind BVIO’s personal agentic computing pitch.