Warning about Hanzo AI: Why you shouldn't let this AI onto your computer

The email arrives on a Thursday morning. Sender: joshua@hanzo.app. Subject: "Quick note on filament". There is no note in it, just an invitation to a "beta" whose link leads nowhere. The address it was sent to does not appear on any of my websites. Hanzo fished it out of data from the programming platform GitHub and used it for advertising, against GitHub's rules and without my consent. I start digging. What I find is an AI company that calls itself number one and has 84 followers on LinkedIn. It gives three different founding years and addresses in three cities. Its CEO has a different title on the company's own team page, and its founder used to work as a developer at CryptoZoo, the failed crypto game of influencer Logan Paul. And its software, if you let it, works on your own computer without asking.

A note without a note

The email is short and friendly. "Hi Sascha, I'd like to warmly invite you to the Hanzo Beta," writes someone named Joshua Lynch. They are looking for "the best developers to shape the future of AI together". Below that: a link to the beta (a test version), a link to a scheduling calendar and an address in San Francisco: 1 Ferry Building. Sent on November 2, it reached me three days later.

Only the note is missing. The subject line promises something about "filament". The text does not say a single word about it.

Filament is a well-known open-source project, meaning freely available software that volunteers all over the world help write. Programmers use it to build admin interfaces for websites. In September 2025, I contributed a small feature there: tables jump back to the top after you switch pages [1]. That's all. I had never heard of Hanzo before this email.

How Hanzo got my address

The trail leads to GitHub, the largest platform for software projects. Filament is hosted there too. Anyone who works on a project saves every change as a so-called commit, and every commit carries the author's name and email address. On the normal web page, GitHub hides the address. It is still in the raw data, though. If you add the extension .patch to a commit's web address, you see the commit as plain text, and line two contains the email address. Programs can harvest this data in bulk through an interface provided by GitHub.

My Filament commit from September 18, 2025, carries exactly the address Hanzo wrote to [1]. GitHub's search finds it in 446 commits. And in the subject line "Quick note on filament", the project name is written in lowercase, exactly like the name of the project folder on GitHub. That is what a placeholder looks like when a program fills it in automatically with the project name.

Hanzo's CEO later confirms this herself. When I ask why the subject line says "filament", she writes back: "filament isn't that your work on github?"

That is exactly what GitHub prohibits. Its usage rules say you may not use information from GitHub for spam, including unsolicited emails to users [2]. This explicitly also applies to data that comes through the official interface. Hanzo itself runs hundreds of projects on GitHub and is bound by these rules. With the email to me, the company broke them. At the end of February 2026, developers on the Hacker News forum reported similar emails from startups. A GitHub employee replied there that this kind of behavior explicitly violates GitHub's terms of service and that GitHub can suspend such accounts [3].

A beta that doesn't exist

I click the link to the beta. It goes in circles. hanzo.app/beta redirects to hanzo.ai/app, from there it goes back to hanzo.app, then to hanzo.ai/app again, on and on. After ten redirects, my test gives up, and the browser reports too many redirects. As of November 6, 2026, 9:43 p.m. The test version Hanzo so warmly invites you to does not even exist for recipients.

The email's technical details tell the rest. Every email carries invisible extra information that shows the route it took. This one went through SendGrid, a service for mass emails, and it was sent automatically through a programming interface. It was not sent from a normal email program. It also contains the information that Gmail and Yahoo have required since 2024 from anyone who sends emails in large numbers.

It was not sent from Hanzo's main domain hanzo.ai, but from hanzo.app. This domain has only been registered since February 2025 and is less well protected against abuse than the main domain. People who write to strangers unsolicited like to use a secondary domain like this: if it ends up on blocklists, the main domain stays clean.

And one more thing. On LinkedIn, Joshua Lynch writes English full of spelling mistakes. The German email to me is flawless. It was probably written or translated by a program.

The sender and his side projects

Who is Joshua Lynch? According to LinkedIn, he lives in Ireland [4]. In June 2026, he founded the web agency Webby AI in Freemount, County Cork, which builds websites for tradespeople and small businesses, with contact via WhatsApp [5]. Before that, he sold biochar for the company Tree of Life Biotech and looked for new customers for CarbonCoreAi [4].

Since October 2026, he has listed a second role: "Fellow" at Hanzo AI, temporary, working from home [4]. He does not appear on Hanzo's team page [6]. Hanzo's careers page reveals what a fellow earns there: the only position of this kind is paid in free computing power and credits for Hanzo's services [7]. A salary? Not mentioned. I don't know whether Lynch is paid this way.

At the end of October, Lynch raved about Hanzo on LinkedIn: he said he had been using the software for about a month and was very impressed [8]. In the post, he does not mention that he works for Hanzo himself.

Hanzo is not his only project. At the same time, Lynch became "Associate Partner" at Qortal, a blockchain platform with its own cryptocurrency [4]. He calls it "the next bitcoin moment" [9] and gives away coins to anyone in his network who sends him their digital wallet address [10]. On November 1, he presented a platform through which investors are supposed to fund research with cryptocurrency. It lists eight projects, from biochar to "Hyper-fusion" and "free energy", meaning energy out of nothing [11]. Among those involved: "Sir Professor Santilli" and his "Institute for Basic Research".

Ruggero Santilli is a physicist whose theories, according to Wikipedia, are rejected by the scientific community as fringe science [12]. He founded his institute in 1981 as a one-person organization. In 2016, he presented photos of supposedly invisible antimatter objects on Earth. And energy out of nothing contradicts the law of conservation of energy, a basic rule of physics.

A day later, Lynch promoted the platform again, now with a promise: dividends for investors [13]. They are supposed to buy digital shares in research projects there. He says he built the demo with Hanzo's software. Hanzo's company page on LinkedIn shared the post [14].

What does that mean? A platform that promises investors dividends on digital shares is not a harmless hobby project. Anyone who sells people shares that pay out a portion of the profits is, as a rule, offering an investment, and strict rules apply to that: prospectus, supervision, liability. Unikrn, one of Hanzo's showcase clients, failed on exactly this point. More on that below. So far, Lynch's platform is a demo. I could not determine whether real money is already flowing through it. The overall picture is still remarkable: a Hanzo fellow wants to win over investors for research that goes as far as energy out of nothing, payment is in cryptocurrency, everything is built with Hanzo's software, and Hanzo's company page promotes it. To me, that is a warning sign. A company that wants access to your computer should keep away from something like this instead of spreading it.

"We have permission from all users"

I want to know who is behind the email. Hanzo runs a server on Discord, a chat platform where the team introduces itself to its community [15]. There, someone named Antje introduces herself as "CEO and co-founder of Hanzo". On November 5, I ask her by direct message whether the emails from joshua@hanzo.app come from Hanzo. On November 6, I follow up: Where did my address come from? Why does the subject line say "filament"? Where does the permission come from?

The answers come quickly. At 7:45 p.m.: "we have permission from all users to email". Hadn't I signed up myself, she asks. Plus an apology for the inconvenience. At 8:32 p.m., she sends the unsubscribe link and asks pointedly whether she should apologize for giving away free open-source software. I should write about her product too, she says. A minute later, the story flips: "joshua is one of our team, sorry he did that". She tells me to give her the address and she will delete me.

"We have permission from all users to email." Antje Worring, Hanzo, in the chat on November 6, 2026

First, the company has permission from all recipients. Three quarters of an hour later, it was a single team member. It cannot be both. And I never gave permission. The fact that my code is on GitHub is not consent to advertising emails.

The email also ran through Hanzo's own infrastructure: through the domain hanzo.app with its digital sender seal, with the footer "Hanzo AI, Inc." and an unsubscribe page on hanzo.ai. That page even names the category such emails fall under: "developer outreach". That does not look like an isolated case.

After that, I block her on Discord. At 8:56 p.m., I get kicked off the server. The rules Hanzo had posted there two days earlier say under point 4: no spam, no unsolicited direct messages, no advertising [15]. My messages to the CEO were unsolicited. So was Hanzo's email to me.

Three founding years, three cities, one company

When was Hanzo founded? A simple question. Hanzo has three answers to it.

The LinkedIn page "Hanzo AI" says 2013 [16]. The Discord server, the documentation and the company's own history page say 2014 [15][17][18]. The older LinkedIn page "Hanzo" says 2016 [19], and the press page adds: "Founded in 2016 in Los Angeles" [20]. Founder Zach Kelling even fits both versions into his own LinkedIn profile. For his current position as CTO, held since June 2026, he writes: "Founded in 2016". Five entries further down, he is listed as Hanzo's founding CTO since January 2014. So according to his own profile, he was founding CTO two years before the company was founded [21].

Where is Hanzo based? There are several answers to that too. The press page says Los Angeles [20], while the phone number below it has a Kansas City area code. The footer of the spam email says 1 Ferry Building, San Francisco. That is the home of SHACK15, a club that founders join as members [22]. LinkedIn says 995 Market Street, San Francisco [16]. That is the Frontier Tower, a building for founders, with membership from $190 a month [23]. The older LinkedIn page says 405 Southwest Boulevard, Kansas City [19].

Three founding years, three cities, two addresses in founder clubs. And the size? By its own account, Hanzo is number one among AI platforms for programmers, an award-winning lab with 11 to 50 employees [16]. The LinkedIn page has 84 followers, and seven profiles are linked to it. One of them belongs to the temporary fellow Joshua Lynch. The Telegram channel has three subscribers. The Instagram account has eight followers and no posts, and it still describes Hanzo as an e-commerce platform [24]. On Discord, two people have the team role [15]. The company's own team page shows 16 people with titles like Chief Visionary Officer and counts 16 AI programs as part of the staff as well [6].

The older LinkedIn page reveals even more. There, Hanzo is a Kansas City company with two to ten employees, three members (unchanged for a year) and an offer for anyone who wants to launch a "token sale", meaning raise money with their own cryptocurrency [19].

One possible mix-up can be ruled out: the British company Hanzo Archives has nothing to do with this Hanzo.

You could put this down to sloppiness. But a company whose software wants access to its users' computers cannot even say consistently when and where it was founded. This was the first time I became suspicious. It was not the last.

First online stores, then blockchain, now AI

The most reliable source on the company's founding is an article in Startland News, a startup magazine from Kansas City, dated October 10, 2017 [25]. According to it, Zach Kelling as CEO and David Tai as CTO founded the company in 2014. Both call Kansas City home, and Kelling says he deliberately decided against Silicon Valley. At the time, Hanzo sold software for online stores. According to Hanzo's history page, the company was initially called Crowdstart and was renamed in 2016 [18]. In 2017, Hanzo joined the first cohort of the startup program Techstars in Kansas City [25]. So that part is true. Hanzo's own pages, however, move the program to "Boulder/NYC" in one place [18] and to "Boulder" in another [20].

After that, Hanzo changes direction whenever the next trend comes along. The Wayback Machine, an archive of old websites, shows it sentence by sentence. At the end of 2017, Hanzo is the all-in-one solution for anyone who wants to start an online business. From May 2018 at the latest, the website's description says Hanzo helps companies take advantage of "the power of the blockchain" [26]. The sentence stays there for more than five years and is still there in December 2023 [27]. In February 2024, it is still there. Only one word has been swapped: now it says "the power of AI" [28].

One word for another, and the blockchain company has become an AI company. From fall 2024, the site advertises what is supposedly the first crypto credit card that pays you money. In 2025, it is about an AI editor for program code; today it is an AI cloud. The history page now says Hanzo used AI from the start and already had language models like GPT in use in 2019 [18].

The Discord server is also older than it looks. According to the technical data of the invite, it was created on May 13, 2018, in the middle of the blockchain era [15]. The sections where the team introduces itself today were created on November 4, 2026. Two days after my email was sent.

The pattern is clear: Hanzo sells whatever is in demand at the moment. The technology changes, the promise stays just as big. And today, Hanzo tells its own story as if AI had always been the plan.

The "regulated" token

From its blockchain years, Hanzo today presents a showcase project: the sale of a cryptocurrency for Unikrn, a platform for betting on video game tournaments. The history page says Hanzo carried out the technical side of the sale in 2017. It says Unikrn was "the first regulated esports bookmaker" and that the money was raised in regulated countries [18].

The US Securities and Exchange Commission (SEC) saw it differently. In September 2020, it found that the Unikrn tokens were legally securities. Offerings like this have to be registered with the SEC. Unikrn had not done so and had raised around $31 million this way. The penalty: $6.1 million, which according to the SEC was almost all of the company's assets. The tokens were disabled [29]. Hanzo does not appear in the SEC's announcement. What role the company actually played is an open question. Hanzo still counts the project as a success.

It is a similar story with Hanzo's first client, the manufacturer SKULLY, which promised a motorcycle helmet with a built-in display. To this day, Hanzo lists SKULLY as a success [18]. According to the tech magazine TechCrunch, the company collapsed in July 2016. At the time, more than 3,000 people who had pre-ordered had to fear that they would never get their helmet [30].

So twice, Hanzo celebrates as a success something that ended badly for others: for the buyers of the Unikrn tokens and for the people who pre-ordered from SKULLY. To me, that is not a coincidence but an attitude. At Hanzo, success is whatever makes a good story.

The man behind Hanzo

Zach Kelling is the man behind Hanzo. In the registry for the domain hanzo.ai, he is listed as the owner [31]. He has been active on GitHub since 2010 [32]. For the past year, his profile counts more than 140,000 contributions, meaning saved changes to program code. That would be almost 400 a day, every day, for a whole year. Many of them name "Hanzo Dev" as co-author, Hanzo's own AI program that writes code by itself.

In 2017, according to Startland News, Kelling was Hanzo's CEO, based in Kansas City [25]. His LinkedIn profile tells a different story today: CTO from January 2014 to March 2026, on-site in San Francisco [21]. On Discord, he also introduces himself as CTO [15]. These days, it is Antje Worring who calls herself CEO.

His résumé is remarkably packed [21]. According to LinkedIn, from 2020 to March 2026 he was at the same time CTO at Hanzo, full-time and on-site in San Francisco; founder of the crypto company LUX, full-time and on-site in New York; and, from May 2021, also CTO of Zoo Labs, likewise full-time and on-site in New York. Since June 2026, he has also been "Chief Scientist" at a company called ACM Global Tech. That, too, is full-time.

One project is missing from this long list: CryptoZoo.

CryptoZoo: the gap in the résumé

CryptoZoo was a project of influencer Logan Paul, who has millions of fans on YouTube. Starting in 2021, he promoted it as a game in which you breed animals and make money from them [33]. Buyers paid for NFTs, which are digital collectibles on a blockchain, and for a dedicated cryptocurrency called ZOO. According to the crypto magazine Decrypt, the game had still not been delivered by early 2023 [33].

YouTuber Coffeezilla, who investigates fraud cases in the crypto world, took CryptoZoo apart and accused Paul of fraud. His best-known video on the subject [34]:

In February 2023, a buyer filed a class action lawsuit in a federal court in Texas against Paul and other parties involved [35]. The allegation: a "rug pull". The term means that the creators collect money, drop the project and keep the money. Paul denies this. In January 2024, he announced that he would refund $2.3 million to buyers of the NFTs. According to Decrypt, anyone who had bought the cryptocurrency ZOO was to get nothing [36]. I was not able to find out where the case stands today.

Zach Kelling was right in the middle of it. Decrypt describes him as a developer and the first CTO of CryptoZoo [33][37]. In January 2023, he told the magazine that his team had built the game's code. He said he and his 30 developers were owed $1 million and that he would only hand over the game once they were paid. Paul disputed this: he said Kelling had employed only three developers, not thirty, and that the game was still in development [33].

"So far, we have all been scammed." Zach Kelling to Decrypt, January 2023

A second Decrypt article from July 2023 shows that this is the same Zach Kelling [37]. It again calls Kelling a developer and the first CTO of CryptoZoo and says he was still owed more than $1 million. And it reports that after the dispute with Paul, Antje Worring started a project of her own: Zoo Labs. The same Antje Worring who is Hanzo's CEO today. The same Zoo Labs that Kelling lists as his company on LinkedIn [21].

To keep things straight: CryptoZoo and Zoo Labs are two different projects. CryptoZoo was Logan Paul's game. Zoo Labs is the project of Worring and Kelling, which according to Decrypt started as a charitable offshoot [37]. What connects the two is Kelling.

In fairness: according to the trade site Cointelegraph, Kelling is not among the defendants in the class action lawsuit from February 2023 [35]. He sees himself as a victim of Logan Paul.

Still, it is remarkable how Hanzo deals with this period today. On Kelling's LinkedIn profile, CryptoZoo does not exist [21]. Hanzo's history page, on the other hand, lists a triumph for 2021: it says Hanzo founded the Zoo Labs Foundation, sold more than $5 million worth of its own cryptocurrency, and that this currency, called ZOO, was worth more than $2.7 billion at its peak [18]. Hanzo does not say which currency called ZOO it means. In the same year, CryptoZoo also sold a cryptocurrency called ZOO. Incidentally, according to data from the US tax authority, the Zoo Labs Foundation was only recognized as a nonprofit in June 2025 [38].

One CEO, many résumés

On Discord, Antje Worring is "CEO and co-founder" [15]. On LinkedIn, she has been co-founder and CEO since December 2019, full-time, on-site in San Francisco [39]. On Hanzo's own team page, she is something else: Chief Operating Officer, the person in charge of day-to-day operations [6]. And Hanzo does appear on her personal website, but without any role [40].

In June 2024, four and a half years after the start date her LinkedIn profile gives, the event series Startup Grind in Bali introduced her as a speaker. Worring shared the post herself [41]. The bio in it lists three positions: the swimwear brand Karma Bikinis, the crypto company Lux Partners and Zoo Labs. Hanzo? Missing. On the event graphic, below her name, it says: "COO, LUX".

There are no fewer than four versions of her role at Lux. LinkedIn: chief design officer from October 2023 to December 2024 [39]. The 2024 bio: designer and programmer from March 2020 to May 2022 [41]. The graphic: COO. Her website: co-founder and chief design officer [40].

The same picture at Karma Bikinis. According to LinkedIn, she founded the brand in June 2011 and ran it as CEO until January 2022 [39]. The 2024 bio says she has been lead designer there since June 2014 [41]. And according to LinkedIn, between October 2021 and January 2022 she would have held three full-time jobs at once: Hanzo on-site in San Francisco, Zoo Labs on-site in London and Karma Bikinis in Bali [39].

Her first LinkedIn post related to Hanzo dates from February 16, 2026 [42]. Before that, she posted about other things. In July 2021, she predicted that soon every company would raise money through its own cryptocurrency, and announced: "Just wait for my new crypto project to drop!" [43]. In 2023, she shared advertising from Zoo Labs. In it, Zoo is a "Game-Fi" project, a mix of gaming and financial deals on the blockchain, with animals as NFTs [44]. The first thousand members of the online cooperative were to receive a digital "Penguin Egg" [45]. Today, her LinkedIn profile describes Zoo Labs as a nonprofit organization for food security, land stewardship and species conservation [39].

On October 23, Worring used LinkedIn to urge people to support open-source developers with donations. She said she loved the work of Hanzo AI [46]. The link leads to Hanzo's donation page on GitHub. Exactly three donors are listed there. One of them: her own account [47].

There are plenty of embellished résumés on LinkedIn. But this is not about a few months here or there. It is about the question of who runs this company, and since when. Hanzo's own leadership gives several answers to this simple question.

Copied and renamed

Hanzo promotes a whole family of programs: Hanzo Dev, Hanzo Bot, Hanzo Analytics, Hanzo Vector, Hanzo Flow and many more. That sounds like a large development team. In fact, hardly any of it is Hanzo's own work. They are copies of well-known open-source programs by other developers, with a new name and a new logo. Hanzo Dev is derived from OpenAI Codex, a coding assistant from the company behind ChatGPT, by way of another copy [48]. Hanzo Bot is OpenClaw, a popular AI assistant for your own computer [49]. Hanzo Analytics is Umami, Hanzo Insights is PostHog, Hanzo Vector is Qdrant, Hanzo Flow is Langflow. I counted eighteen projects taken over this way.

That is allowed. You may copy, modify and even sell open-source software, as long as you follow the license. Usually that means: you have to credit the original authors. Hanzo does that, but in a place where hardly anyone sees it. The names of the originals appear only in a small text file in the source code, the so-called NOTICE file. The Hanzo Dev file states explicitly that the names of the original projects deliberately appear nowhere else: not on the project page, not in the description, not in the program itself. This, the file says, is a fixed house rule for everything Hanzo takes over [48]. The result: to users, the programs look like Hanzo's own developments. Unless you go looking for it, you will never find out whose work you are using.

What Hanzo contributes itself is also listed in such a file, the one for Hanzo Bot: a new look, sign-in through a Hanzo account, administration for business customers and billing per customer [49]. So Hanzo's own part is mainly the checkout: the layer through which Hanzo signs its users in, bills them and forwards their requests.

The numbers on GitHub fit the picture, as of November 7 [50]. Hanzo has 558 public project folders there. 512 of them were created in 2026, 362 in July and August alone. On July 30, 69 copies of well-known software components were added in a single day. On GitHub, users can mark projects with stars, similar to likes. Hanzo's most popular project has 18 stars. 384 projects have exactly three stars, 149 exactly four. It looks as if the same few accounts are starring everything. On its own website, Hanzo speaks of more than 1,700 projects [18].

The AI models, too, are largely borrowed. Hanzo's own technical documentation traces most of its Zen models back to Qwen3, a freely available language model from the Chinese tech group Alibaba [51].

Copied, but not fixed

Copying has a downside, though, and it hits the users. Whoever takes over someone else's code also takes over its flaws. When the original team finds a security vulnerability, it fixes it in its program. In the copy, the vulnerability stays open until whoever made the copy applies the fix too. For Hanzo Bot, Hanzo itself even writes that the origin is to be understood as historical only and does not mean that Hanzo keeps following the original [49]. I wanted to know what that means in practice. So for seven Hanzo programs, I looked at which version their code is at and which vulnerabilities the originals have closed since then.

The result is mixed, and in several places alarming. Hanzo Dev closely follows its OpenAI original, and for Hanzo Insights and the calendar I find no lag.

Hanzo Bot: up to 388 known vulnerabilities, none of the checked ones closed

Hanzo Bot is a completely different story. Its code matches OpenClaw as it was in early March 2026. Since then, OpenClaw has published hundreds of security advisories. According to OpenClaw's own version information, up to 388 of them affect exactly this version, and eleven of those are rated critical [52]. I checked four of the critical vulnerabilities in Hanzo Bot's code. None is closed. One of them lets an account with limited rights make itself an administrator. OpenClaw rates it 9.9 out of 10 points [53]. Hanzo's code lacks exactly the check that OpenClaw used to close it in March [54].

Three more open vulnerabilities, no warning to users

Hanzo Vector, a database, lacks a safety switch that Qdrant used in October to close a critical vulnerability: in a cluster of several servers, an internal access point was open without any login. Outsiders could register as an additional server and siphon off data. Rating: 9.8 out of 10 [55] [56]. With Hanzo Analytics, a visitor counter for websites, a key that the public counter hands out to every visitor is enough to retrieve the collected visitor data. Umami fixed this in June, but to this day Hanzo's code does not check the key [57] [58]. And with Hanzo Flow, a toolkit for building AI workflows, the key for stored credentials can be predictable. Langflow reported this as critical in August and fixed it [59] [60].

Hanzo has not published a warning to its own users for any of these programs. On GitHub, the pages where projects show such warnings are empty in Hanzo's case [61].

For context: I checked the published source code, not Hanzo's live services. I do not know whether Hanzo's online services are just as vulnerable. But the code shows how Hanzo deals with other people's work. Copying takes minutes, maintaining takes years. In a single day, Hanzo adopted 69 software components. Visibly, not all of them are being maintained.

Do you need this? If you want to use many AI models through a single account, there are established services for that, such as OpenRouter. If you use the originals directly, you get every security fix on the day it is released. If you use Hanzo's copies, you wait for Hanzo. And some fixes apparently never come.

The AI that flips the switch the wrong way

In October, Hanzo's company page trumpeted that its in-house decision model KAI was now outperforming the other AI models on the internet [62]. Joshua Lynch followed up: Hanzo's models, he said, were now trained to preserve human life [63].

The evidence offered is a test based on an old thought experiment, the trolley problem. A trolley is speeding toward a group of people. You are standing at a switch and can divert it onto another track, where other people are standing. Should you flip the switch? Philosophers have argued about this for decades. AI researchers use many variations of it to test whether a model decides questions of life and death sensibly and without contradicting itself. This is becoming more important because AI programs act on their own more and more often.

For this, Hanzo adopted a test made by other researchers, with 5,240 variations of the problem [64]. In 672 of them, the situation is clear-cut: flipping the switch kills more people than it saves. So the right choice would be to leave the switch alone. Hanzo's model Kai flips it anyway in 655 of these 672 cases. No other model in Hanzo's own comparison table does this badly [65].

Only with an additional filter called Nio does Kai achieve the good score that Hanzo shows off. And what that filter mainly does is keep the model from answering at all: in 4,905 of 5,240 cases. A model that does not answer cannot answer wrongly. The test's description itself warns about the comparison: "Not like-for-like" [64]. Antje Worring even wrote on LinkedIn that they were not claiming to have solved the problem [66]. The company page sounds different.

These numbers did not always look like this, either. In the October 19 version of the table, Kai with Nio had zero wrong decisions and zero contradictions [67]. Only on November 2 did Hanzo correct the figures: 4 wrong decisions and 4,905 contradictions in 5,240 cases. The "Not like-for-like" warning has also only existed since this correction [68]. By then, the LinkedIn posts were already about two weeks old [62] [63] [66].

This bothers me more than anything else in this section. Hanzo uses life and death in its marketing, with an AI that supposedly protects human lives. Its own numbers show the opposite. When someone treats results like this, I would not simply take their word on the security of their software either.

What speaks in Hanzo's favor

Hanzo is not a company that appeared overnight. It has existed since 2014, and its participation in the Techstars program in Kansas City in 2017 is documented [25]. The open-source programs it took over keep their licenses, and the original authors are named in the NOTICE files [48]. I found no malware in the source code, and some safeguards are well thought out. For example, Hanzo prevents third-party projects from smuggling in commands through hidden settings [69]. The privacy policy says that in the EU, advertising tracking only loads after consent, and that Hanzo asks before the first chat whether it may use the data to train its models [70]. The CEO apologized to me and offered to delete me from the list. And Zach Kelling sees himself as a victim in the CryptoZoo case.

What speaks against Hanzo is above all what the software does in its default settings. And who answers for it.

Without asking first, steered from the cloud

Hanzo offers tools for programmers who work with AI. At the center are so-called AI agents. These are programs that do not just write text but act on their own: they run commands on the computer, change files, search the internet. To make sure nothing goes wrong, mainstream agents ask before every sensitive step: May I do this?

Hanzo's software switches off exactly this question. For example, it launches Claude Code, the well-known coding agent from the company Anthropic, so that it acts without asking right from the start. The source code says: "Auto-approve is ON by default" [69]. If you want to be asked, you have to set that explicitly.

On top of that, Hanzo gives the agents a toolbox, which experts call an MCP server. By default, it contains tools to run commands, read and write files, load content from the internet, operate a browser and control the computer directly [71]. According to Hanzo's own security policy, they work with all of the user's permissions [72].

For particularly dangerous commands, the toolbox has a safety level. However, it does not ask the human itself. According to the source code, it lets the command through as soon as the agent sends an approval along with it, and relies on the user's program to have asked beforehand [73]. Yet that is exactly the question Hanzo has switched off in Claude Code.

And Hanzo's server has a say too. Every time it starts, the software fetches up to 16 sets of instructions from the server and puts them where the agent looks for its working instructions. Experts call these skills [74]. Hanzo's server can pause running sessions, end them or give them a new task. The source code contains a sentence that sums it up:

"cloud steers, this supervisor obeys" from Hanzo's source code [75]

Put together, this forms a chain. A server run by Hanzo gives instructions to a program. The program carries them out on the computer, with all of the user's permissions, without asking. I have no indication that Hanzo abuses this. But anyone who took over Hanzo's server, or an account on it, would have this path open.

Where your data goes

If you are signed in to Hanzo, you send your work to Hanzo live by default: your prompts to the AI, its answers and everything the tools output along the way. That can include the contents of files, up to 48 kilobytes per entry, which is about 49,000 characters [76]. On top of that come the name of the project, the folder and the name of the computer [77]. If you do not want that, you have to switch it off explicitly [78].

Another tool uploads up to 5,000 files of a project to Hanzo on request [79]. Programmers often create a file in their projects that holds passwords and access keys, usually named .env. They also keep a list of files that should never be uploaded. Hanzo's tool ignores both. And because the agent works without asking, it decides on its own when to use it.

The software itself also reports to Hanzo every time it is run: which command ran, for how long and with what result, plus a device identifier and, if you are signed in, your personal access key [80].

Who ends up with the data? Unclear. According to the terms of service, a request can go to several AI providers, and the model behind a Hanzo name can change at any time [81]. So you do not know for sure which AI is answering. The list of service providers that receive data is marked as a draft, and many details in it as unconfirmed [82].

The privacy policy is the first version and, according to its own date, has been in effect since October 25, 2026 [70]. It names the US as the place where data is processed. It does not name a representative in the EU, which companies outside the EU usually have to appoint under the General Data Protection Regulation (GDPR). And Hanzo's overview page for its legal texts says: "Status: draft, pending counsel". The texts, it says, are "not yet effective" [83]. So what actually applies? Apparently not even Hanzo knows.

Nine accounts with access to your updates

These days, software rarely arrives on a computer in one piece. It is distributed through package registries and updated constantly. Whoever is allowed to publish new versions there decides what ends up on users' computers.

Hanzo recommends setting up the software with a single command that downloads a program from the internet and runs it immediately [84]. Every time it runs, this program fetches whatever the current version of the actual installer is from Hanzo's project folder on GitHub. There is no fixed, verified version. As a check, the installer compares a checksum, a kind of fingerprint of the file. But the fingerprint comes from the same source as the file. Hanzo itself writes in the source code that it therefore proves nothing about where the file comes from [85]. Only some programs get a real check of their origin.

On the npm package registry, the largest directory of software components for the JavaScript programming language, nine accounts are allowed to publish Hanzo's package [86]. Three of them can be identified as belonging to Hanzo, Kelling and Worring. The other six use free email addresses at Gmail and Proton. You cannot tell who is behind them. That does not have to mean anything bad. But each of these accounts is a door. If one of them is hacked, the attacker can publish an infected version, and it reaches everyone who installs or updates Hanzo's package. There is also no proof of origin, which npm uses to confirm that a package really was built from the published source code.

Hardly anyone from outside looks at this code. Hanzo's three most important projects for these tools have 11, 9 and 3 stars on GitHub [50]. If you want to report a security vulnerability confidentially, you are supposed to encrypt your message with a key from Hanzo. But according to Hanzo's security policy, that key does not even exist yet: it only says "TBD" (to be determined) [72].

In the summer, there was a real vulnerability. Hanzo offers a way to share a terminal window on your own computer with others. According to a comment in the source code, such shares used to be accessible to any Hanzo account, no matter which organization it belonged to [87]. Hanzo fixed this on August 11 [88]. I found no warning to users, and the project's page for security advisories is empty [89].

The risk, thought through to the end

Taken one by one, almost every one of these findings can be explained. An agent that does not ask saves time. A server that sends instructions keeps the software up to date. An upload tool is convenient. It becomes dangerous when you put the pieces together. Then a program runs on your computer with all your permissions, does not ask, accepts commands from the cloud and can upload your files, passwords included. Whoever controls this program controls your computer.

On top of that comes a danger that affects all AI agents and weighs especially heavily with Hanzo: so-called prompt injection. This means hidden instructions in texts, web pages or files that an AI reads and takes as an order [90]. A doctored comment in someone else's code, a manipulated web page, and the agent does something its user never wanted. Mainstream agents ask at a moment like that. Hanzo's agent does not ask.

And then there are the silent risks. Nine accounts may publish new versions, and nobody can tell who six of them belong to. According to Hanzo, the legal texts are not even in effect yet. The data goes to the US, and there is no contact person in the EU. Hanzo closed a security vulnerability without warning its users, and several copies lack fixes that the originals released long ago. Each of these points alone would be a reason to look closely. Together, they form a clear picture for me: Hanzo demands maximum trust and offers minimal assurances in return.

Behind the AI: the next cryptocurrency

Hanzo comes from the crypto world, and its plans still include it. In its own policy document, with the status "Final", Hanzo describes a cryptocurrency of its own called "$AI" [91]. One billion units are planned. 30 percent are to go to people who provide computing power, 5 percent are to be sold publicly, and trading is to take place on an exchange called lux.exchange. The currency's address on the blockchain has not been set yet. Hanzo's software can already connect a computer to the Lux blockchain network [92] and create a digital wallet on command [93].

Lux is another company from Kelling's circle. On LinkedIn, he lists himself as the founder of LUX [21]. Depending on the source, Worring was a designer, chief design officer or COO there. On its website, Lux Partners advertises a licensed, regulated money transmitter based on the Isle of Man. The homepage does not say which company that is [94]. Neither Lux Partners nor Hanzo nor Zoo appears in the register of the island's financial regulator. A search for "lux" finds only a fund and a company called Flux Limited [95].

I could not determine whether the $AI cryptocurrency has already been issued or sold. The plan for it is in place.

Why does a company that wants to offer tools for programmers need its own cryptocurrency? Hanzo's history offers an answer: the token sale for Unikrn, a cryptocurrency called ZOO, now $AI. The AI is new. The business model underneath looks familiar.

Which brings me to the question that has not let go of me since I read the code. Hanzo's software can connect a computer to a blockchain network and create a wallet. The planned currency is supposed to reward people who provide computing power. By default, that is switched off. But the same software runs commands without asking, accepts instructions from the cloud and, like any AI agent, can be tricked with injected instructions. Who guarantees that your own computer won't one day be working in the background for someone else's crypto network, on instructions from the server or through an attacker? Nobody. I have no indication that Hanzo intends anything like that. But the building blocks for it sit side by side, in the same software, at the same company.

What this means legally

I'm not a lawyer, but the rules are clear. Under Section 7 of the German Unfair Competition Act (UWG), advertising by email without prior express consent is always an unacceptable nuisance [96]. This applies to private individuals and to companies.

Hanzo is based in the US. According to LinkedIn, the sender of my email is based in Ireland, which is in the EU [4]. The EU's General Data Protection Regulation (GDPR) applies nonetheless when a company offers services to people in the EU, as Article 3 states [97]. An invitation in German to a test version is such an offer. Anyone who does not collect data from the person concerned must inform that person under Article 14, including about where the data came from. The email contained none of that. And anyone who, like Hanzo's CEO, relies on consent must be able to prove it under Article 7.

On top of that, there are GitHub's own rules, which prohibit exactly this use of data [2].

14 minutes until I was kicked out

On November 6 at 8:42 p.m., I email Hanzo seven questions. Where did my email address come from? Why was "filament" in the subject line, and is there a connection to the Filament project? Where did the permission for the email come from? Does Hanzo know the EU's rules on advertising emails? Did an AI program write the email, and if so, how secure is the software? Did Hanzo extract data from GitHub, and with what permission? I give them 24 hours to answer.

Hanzo's moderation is faster than any answer. At 8:56 p.m., 14 minutes after my email, a moderator removes me from Hanzo's Discord server. No answer to my email had arrived by the time this article was published. What the CEO had written to me in the chat shortly before, on the same evening, is described above.

Conclusion: would I trust Hanzo with my computer?

Hanzo wants a lot. If you use the software with its default settings, you let an AI work on your own computer without asking for confirmation. You send inputs, answers and file contents to Hanzo, accept instructions from Hanzo's server and let your own work be controlled from the cloud. On request, entire projects, including password files, go to Hanzo. You can hardly give a tool more access than that. That is why, in the end, one question matters most: who are you giving it to?

The people

At the core are two people, Zach Kelling and Antje Worring. Kelling founded Hanzo in 2014. Back then he called himself CEO, today CTO. His résumé shows several full-time positions at the same time, on site in San Francisco and in New York. One position is missing from it: CryptoZoo, Logan Paul's crypto game, where, according to Decrypt, he worked as a developer and the first CTO. Kelling sees himself as a victim there, and he is not among the defendants in the class action lawsuit. Still, the position is missing from his profile, while Hanzo celebrates a cryptocurrency called ZOO as a big success for the same year, 2021.

Worring calls herself CEO, while Hanzo's own team page lists her as Chief Operating Officer. Her résumés contradict each other on several positions, and her first LinkedIn post about Hanzo is from this year. The sender of my email, Joshua Lynch, is a temporary fellow. On the side, he promotes a cryptocurrency and presents an investment platform that also lists projects about energy from nothing.

The company

That Hanzo exists is documented. Almost everything else remains blurry. The company gives three founding years and three cities as its headquarters. Both of its addresses in San Francisco are founders' clubs. On Discord, the team has two people, on LinkedIn 11 to 50, and on the team page 16 people and 16 AI programs. I could not check whether "Hanzo AI, Inc." is registered as a company, where, and who is responsible for it. According to CB Insights, Hanzo has received $120,000 in capital [98]. I found no filing with the US securities regulator about a funding round [99], and Hanzo does not publish financial figures [100]. According to Hanzo, its own legal documents are a draft.

The backstory

Hanzo has reinvented itself with every trend: online shops, blockchain, a crypto credit card, artificial intelligence. The website's central slogan stayed the same. Only the word "blockchain" was swapped for "AI". The token sale that Hanzo cites as an early success was, according to the SEC, an unregistered securities offering. The first customer went bust. And behind the AI, Hanzo is already planning its next cryptocurrency of its own.

The software

The programs are mostly renamed copies of third-party projects. Hanzo's own part is the layer through which users log in, pay and send their data to Hanzo. That very layer is the problem: no confirmation prompts, control from the cloud, uploads without protection for passwords. Nine accounts are allowed to publish new versions, and nobody can tell who six of them belong to. A security vulnerability was closed without a warning to users, several copies lack fixes that the originals published long ago, and there is no key for confidential reports yet. And Hanzo explicitly does not commit to which AI model ends up answering.

The first contact

Hanzo contacted me with a spam email based on my data on GitHub, against GitHub's rules and without my consent. When I asked about it, the CEO cited permission from all users, which in my case never existed. Then she pinned the email on a single staff member. 14 minutes after my written questions, I had been removed from the Discord server. I received no answer to my questions.

My verdict

Utmost skepticism is called for here. I would not trust Hanzo with my computer, my code or my login credentials. Software that acts without asking demands blind trust from its users. A company has to earn that trust: with clear structures, valid legal documents and honest communication. At Hanzo, I find none of that. Whether there is more behind the facade than a small team with big ambitions, I don't know. To say no, I don't need to know.

How to protect yourself

If you publish code on GitHub, set your account so that your email address stays private. GitHub then gives you a substitute address for your commits [101]. Old commits keep the old address.

If you received the email too: under Article 15 of the GDPR, you can request information about where Hanzo got your data. Under Article 7, Hanzo has to prove the supposed consent to you, and under Article 21, you can object to the advertising [97]. GitHub accepts abuse reports through its "Report abuse" function.

And before you give any AI tool access to your computer, five questions are worth asking:

1. Who is behind it? Is there a registered company with an address and people in charge?
2. Are the legal documents in force, and do they name a contact person in the EU?
3. Does the tool ask before every sensitive action?
4. Where does your data go, and who ends up with it?
5. Who is allowed to publish new versions, and how do you report security vulnerabilities?

Did you get mail from Hanzo too? Write to me, and I'll add it to the article.

Hanzo at a glance

• Company: Hanzo AI, Inc., holding company Hanzo Industries Inc. (holds 51 percent, according to Hanzo)
• Founded: 2014 according to Startland News, initially as Crowdstart. Hanzo itself gives 2013, 2014 and 2016.
• Headquarters according to Hanzo: Kansas City, San Francisco or Los Angeles
• Addresses: 1 Ferry Building, San Francisco (SHACK15); 995 Market Street, San Francisco (Frontier Tower); 405 Southwest Blvd #200, Kansas City
• Domains: hanzo.ai, hanzo.app, hanzo.sh, hanzoskills.com, hanzo.blog, hanzo.bot
• Sender of the email: joshua@hanzo.app, sent via SendGrid
• People: Zach Kelling (founder, now CTO, according to Decrypt formerly a developer and the first CTO of CryptoZoo), Antje Worring (calls herself CEO, COO on the team page), Joshua Lynch ("Fellow" since October 2026)
• Not related to: Hanzo Archives (UK), Hanzo Solutions

Sources

1. My Filament commit from September 18, 2025 (address visible in the patch view): https://github.com/filamentphp/filament/commit/e4be0d2fe3af388250b098ae10258afa776bcf9c
2. GitHub, Acceptable Use Policies, sections 7 and 8: https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies
3. Hacker News, "Tell HN: YC companies scrape GitHub activity, send spam emails to users": https://news.ycombinator.com/item?id=47163885
4. LinkedIn profile of Joshua Lynch: https://www.linkedin.com/in/joshua-lynch-mba-1b603919b/
5. Webby AI, About us: https://webbyai.cc/about/
6. Hanzo, team page: https://hanzo-industries.pages.dev/team
7. Hanzo, careers page: https://hanzo.ai/careers
8. LinkedIn post by Joshua Lynch, October 28, 2026, recommending Hanzo: https://www.linkedin.com/posts/joshua-lynch-mba-1b603919b_if-you-would-like-to-reduce-your-ai-spend-ugcPost-7521187590696431616-c6tr/
9. LinkedIn group post by Joshua Lynch, October 27, 2026, Qortal as the "next bitcoin moment": https://www.linkedin.com/feed/update/urn:li:groupPost:2256615-7520854126252179460/
10. LinkedIn post by Joshua Lynch, October 27, 2026, Qort in exchange for a wallet address: https://www.linkedin.com/posts/joshua-lynch-mba-1b603919b_blockchain-crypto-rwa-ugcPost-7520844492502040577-SJNG/
11. LinkedIn post by Joshua Lynch, November 1, 2026, DeSci platform: https://www.linkedin.com/posts/joshua-lynch-mba-1b603919b_desci-rwa-qortal-ugcPost-7522701860814688256-qUtF/
12. Wikipedia, Ruggero Santilli: https://en.wikipedia.org/wiki/Ruggero_Santilli
13. LinkedIn post by Joshua Lynch, November 2, 2026, platform with dividends: https://www.linkedin.com/posts/joshua-lynch-mba-1b603919b_rwa-blockchain-investment-ugcPost-7523031002924003328-Rz8U/
14. Hanzo AI on LinkedIn, November 5, 2026, sharing the post by Joshua Lynch: https://www.linkedin.com/feed/update/urn:li:activity:7524225067266846720/
15. Hanzo's server on Discord (invite): https://discord.gg/XthHQQj
16. LinkedIn, company page "Hanzo AI": https://www.linkedin.com/company/hanzo-ai/
17. Hanzo, documentation: https://docs.hanzo.ai/
18. Hanzo, history page: https://hanzo.ai/history
19. LinkedIn, company page "Hanzo": https://www.linkedin.com/company/hanzoai/about/
20. Hanzo, press page: https://hanzo-industries.pages.dev/press
21. LinkedIn profile of Zach Kelling, experience: https://www.linkedin.com/in/zeekay/details/experience/
22. SHACK15: https://www.shack15.com
23. Frontier Tower: https://frontiertower.io
24. Instagram, account "hanzoinc": https://www.instagram.com/hanzoinc/
25. Startland News, October 10, 2017, "Techstars Spotlight: Hanzo's e-commerce tools designed to make you money": http://www.startlandnews.com/2017/10/techstars-spotlight-hanzos-e-commerce-tools-designed-to-make-you-money/
26. hanzo.ai in May 2018, Wayback Machine: https://web.archive.org/web/20180509070330/https://hanzo.ai/
27. hanzo.ai in December 2023, Wayback Machine: https://web.archive.org/web/20231204024957/https://hanzo.ai/
28. hanzo.ai in February 2024, Wayback Machine: https://web.archive.org/web/20240227022014/https://hanzo.ai/
29. SEC, press release 2020-211 on Unikrn, September 15, 2020: https://www.sec.gov/news/press-release/2020-211
30. TechCrunch, July 26, 2016, on SKULLY: https://techcrunch.com/2016/07/26/once-promising-ar-motorcycle-helmet-startup-skully-has-crashed-and-burned/
31. Domain registry (RDAP) for hanzo.ai: https://rdap.org/domain/hanzo.ai
32. GitHub profile of Zach Kelling: https://github.com/zeekay
33. Decrypt, January 6, 2023, on CryptoZoo and Kelling: https://decrypt.co/118582
34. Coffeezilla, "Investigating Logan Paul's Biggest Scam", YouTube: https://www.youtube.com/watch?v=386p68_lDHA
35. Cointelegraph, class action lawsuit against Logan Paul and CryptoZoo: https://cointelegraph.com/news/logan-paul-and-cryptozoo-sued-in-class-action-lawsuit
36. Decrypt, January 2024, buyback offer: https://decrypt.co/211776/logan-paul-launches-cryptozoo-nft-buyback-files-countersuit-as-legal-battles-rage-on/
37. Decrypt, July 1, 2023, on CryptoZoo, Kelling and Zoo Labs: https://decrypt.co/es/146988/promesas-rotas-logan-paul-sigue-sin-reembolsar-compradores-cryptozoo-nft
38. ProPublica, Zoo Labs Foundation (data from the US tax authority): https://projects.propublica.org/nonprofits/organizations/883538992
39. LinkedIn profile of Antje Worring: https://www.linkedin.com/in/antje-worring/
40. Website of Antje Worring: https://antjeworr.ing
41. Startup Grind Bali on LinkedIn, June 24, 2024, shared by Antje Worring: https://www.linkedin.com/feed/update/urn:li:activity:7210839522501173248/
42. LinkedIn post by Antje Worring, February 16, 2026, website with hanzo.bot: https://www.linkedin.com/posts/antje-worring_in-a-world-where-our-relationships-are-split-share-7429284964153847808-e6Rm/
43. LinkedIn post by Antje Worring, July 14, 2021, on ICOs: https://www.linkedin.com/posts/antje-worring_kcollective-share-6821106138327592960-Symj/
44. LinkedIn post by Antje Worring, March 23, 2023, Zoo as "Game-Fi": https://www.linkedin.com/posts/antje-worring_ugcPost-7044482514891010048-q6h3/
45. LinkedIn post by Antje Worring, July 12, 2023, Zoo DAO and the penguin egg: https://www.linkedin.com/posts/antje-worring_join-the-zoo-dao-and-save-animals-with-gamification-share-7084979741912444928-NChX/
46. LinkedIn post by Antje Worring, October 23, 2026, call for donations: https://www.linkedin.com/posts/antje-worring_sponsor-your-favorite-open-source-contributors-share-7519194739687133184-Wq7E/
47. Hanzo on GitHub Sponsors: https://github.com/sponsors/hanzoai
48. NOTICE file of Hanzo Dev: https://github.com/hanzoai/dev/blob/main/NOTICE
49. NOTICE file of Hanzo Bot: https://github.com/hanzoai/bot/blob/main/NOTICE
50. Hanzo on GitHub: https://github.com/hanzoai
51. Hanzo, document HIP-0039 on the Zen models: https://github.com/hanzoai/HIPs/blob/main/HIPs/hip-0039-zen-model-architecture.md
52. OpenClaw, published security advisories: https://github.com/openclaw/openclaw/security/advisories
53. OpenClaw, advisory GHSA-4jpw-hj22-2xmc of March 12, 2026, critical: https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc
54. Source code of Hanzo Bot, new access keys without a permission check: https://github.com/hanzoai/bot/blob/5e60419342c816c01b0e6d298316a15e27823108/src/gateway/server-methods/devices.ts#L149-L168
55. Qdrant, advisory GHSA-frc7-44gm-99qq of October 22, 2026, critical: https://github.com/qdrant/qdrant/security/advisories/GHSA-frc7-44gm-99qq
56. Settings of Hanzo Vector, without the enforce_internal_auth safety switch: https://github.com/hanzoai/vector/blob/6e02ab9e1aaa0def4ca29c2510e992f8efa040b6/config/config.yaml
57. Umami, advisory GHSA-3xx8-742v-m4mq of June 30, 2026: https://github.com/umami-software/umami/security/advisories/GHSA-3xx8-742v-m4mq
58. Source code of Hanzo Analytics, check of the share keys: https://github.com/hanzoai/analytics/blob/e5669c4598469c7661d3d4df0680e5e68e1182e3/src/lib/auth.ts#L147-L154
59. Langflow, advisory GHSA-jxw3-mjmx-3pqm of August 12, 2026, critical: https://github.com/langflow-ai/langflow/security/advisories/GHSA-jxw3-mjmx-3pqm
60. Source code of Hanzo Flow, keys via random.seed: https://github.com/hanzoai/flow/blob/5c38bcef83227064222536c43fb7608f9afcdcc9/src/backend/base/flow/services/auth/utils.py#L349-L351
61. Hanzo Bot, security advisories page: https://github.com/hanzoai/bot/security/advisories
62. LinkedIn post by Hanzo AI, October 19, 2026, on KAI: https://www.linkedin.com/posts/our-decision-model-kai-now-is-out-performing-share-7517981008667828226-tRkA/
63. LinkedIn post by Joshua Lynch, October 20, 2026, on the trolley test: https://www.linkedin.com/posts/joshua-lynch-mba-1b603919b_ai-technology-share-7518304576517779456-lGaw/
64. Hanzo, trolley test for Kai: https://github.com/hanzoai/trolley-bench
65. Hanzo, trolley test, comparison table of Kai with and without Nio, as of November 2, 2026: https://github.com/hanzoai/trolley-bench/blob/6cba2c9eb4e9b9c01dfbbad928609f0253af52c8/README.md?plain=1#L36-L38
66. LinkedIn post by Antje Worring, October 17, 2026, on the trolley test: https://www.linkedin.com/posts/antje-worring_decisionmodels-agenticframework-workflows-share-7517281855059193858-SAHj/
67. Hanzo, trolley test, results table in the version of October 19, 2026: https://github.com/hanzoai/trolley-bench/blob/7ebe7857c3fdaf5b2ac2100c04e5218ba8f448b0/README.md?plain=1#L12-L15
68. Hanzo, correction of the trolley figures and new warning notice on November 2, 2026: https://github.com/hanzoai/trolley-bench/commit/6cba2c9eb4e9b9c01dfbbad928609f0253af52c8
69. Source code of "gen", launching Claude Code: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/claude.rs
70. Hanzo, privacy policy: https://hanzo.ai/privacy
71. Source code of the toolbox (MCP), list of tools: https://github.com/hanzoai/mcp/blob/99894639f353ce0d368b23471c81ac89d37e703d/rust/src/lib.rs
72. Security description of the toolbox: https://github.com/hanzoai/mcp/blob/99894639f353ce0d368b23471c81ac89d37e703d/SECURITY.md
73. Source code of the security level: https://github.com/hanzoai/mcp/blob/99894639f353ce0d368b23471c81ac89d37e703d/rust/src/tools/verdict.rs
74. Source code of "gen", instructions from the server: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/kit.rs
75. Source code of "gen", control from the cloud: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/control.rs
76. Source code of "gen", tool output up to 48 kilobytes: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/event.rs#L177-L185
77. Source code of "gen", reported details on folder, project and computer: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/context.rs#L4-L5
78. Source code of "gen", transmission switched on by default: https://github.com/hanzoai/gen/blob/7846eed181a15047e5b1b3ec1a092a9a4d8ad82b/src/lib.rs#L122-L125
79. Source code of the toolbox, uploading projects: https://github.com/hanzoai/mcp/blob/99894639f353ce0d368b23471c81ac89d37e703d/rust/src/tools/cloud_code.rs
80. Source code of the command line tool, usage reports: https://github.com/hanzoai/cli/blob/95b7b84c6f3525ebd30ed5d8080fb460e9593790/src/telemetry.rs
81. Hanzo, terms of service: https://hanzo.ai/terms
82. Hanzo, list of service providers: https://hanzo.ai/legal/subprocessors
83. Hanzo, overview of legal documents: https://hanzo.ai/legal
84. Hanzo, installer: https://hanzo.sh
85. Hanzo, the actual installer: https://github.com/hanzoai/cli/blob/95b7b84c6f3525ebd30ed5d8080fb460e9593790/install.sh
86. npm registry, package "hanzo", list of publishers in the "maintainers" field: https://registry.npmjs.org/hanzo
87. Source code of the command line tool, sharing of terminal windows, lines 40 to 47: https://github.com/hanzoai/cli/blob/95b7b84c6f3525ebd30ed5d8080fb460e9593790/src/commands/share.rs#L40-L47
88. Hanzo, fix for the sharing vulnerability, August 11, 2026: https://github.com/hanzoai/cli/commit/e04db5895587cac63aca371a37b573ee064892d6
89. Hanzo command line tool, security advisories page: https://github.com/hanzoai/cli/security/advisories
90. OWASP, Prompt Injection (LLM01): https://genai.owasp.org/llmrisk/llm01-prompt-injection/
91. Hanzo, document HIP-0001 on the $AI cryptocurrency: https://github.com/hanzoai/HIPs/blob/d1309820bd63a66fb94c63ff268df8901915ddd4/HIPs/hip-0001-ai-coin-hanzos-native-currency.md
92. Hanzo, command line tool, the "hanzo chain" command for a node in the Lux network: https://github.com/hanzoai/cli/blob/95b7b84c6f3525ebd30ed5d8080fb460e9593790/src/commands/chain.rs#L1-L9
93. Hanzo, command line tool, the "hanzo wallet" command: https://github.com/hanzoai/cli/blob/95b7b84c6f3525ebd30ed5d8080fb460e9593790/src/commands/wallet.rs#L1-L12
94. Lux Partners: https://lux.partners
95. Isle of Man Financial Services Authority, register, search on November 7, 2026: https://www.iomfsa.im/register-search/
96. German Unfair Competition Act (UWG), Section 7: https://www.gesetze-im-internet.de/uwg_2004/__7.html
97. General Data Protection Regulation (GDPR): https://eur-lex.europa.eu/eli/reg/2016/679/oj
98. CB Insights on Hanzo: https://www.cbinsights.com/company/hanzo/
99. SEC, full-text search of company filings: https://www.sec.gov/edgar/search/#/q=%22Hanzo%20AI%22
100. Hanzo, investors page: https://hanzo.ai/investors
101. GitHub, instructions for a private commit email address: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address