import{c as a,Q as t,j as s,m as n}from"./chunks/framework.BPKcPtvA.js";const u=JSON.parse('{"title":"The 6-Level Security Ladder","description":"","frontmatter":{},"headers":[],"relativePath":"blog/posts/security-ladder.md","filePath":"blog/posts/security-ladder.md","lastUpdated":null}'),o={name:"blog/posts/security-ladder.md"};function l(r,e,i,p,c,h){return t(),s("div",null,[...e[0]||(e[0]=[n(`<h1 id="the-6-level-security-ladder" tabindex="-1">The 6-Level Security Ladder <a class="header-anchor" href="#the-6-level-security-ladder" aria-label="Permalink to &quot;The 6-Level Security Ladder&quot;">​</a></h1><p><strong>May 26, 2026</strong></p><p>Every AI agent has access to bash. One tool — every dangerous verb: <code>rm -rf</code>, <code>curl</code>, <code>git clean -fdx</code>, <code>terraform destroy</code>, <code>DROP DATABASE</code>.</p><p>The math is brutal. At a 1% per-turn failure rate, there&#39;s a <strong>63.4% chance of catastrophe over 100 turns</strong>. This isn&#39;t theoretical — it&#39;s the actual threat model for every agent in production.</p><p>Most engineers stop at Level 2 (system prompt rules) and think they&#39;re safe. They&#39;re not. Here&#39;s the full 6-level ladder that actually works.</p><h2 id="level-0-acip-prompt-injection-defense" tabindex="-1">Level 0: ACIP (Prompt Injection Defense) <a class="header-anchor" href="#level-0-acip-prompt-injection-defense" aria-label="Permalink to &quot;Level 0: ACIP (Prompt Injection Defense)&quot;">​</a></h2><p>Before bash security, there&#39;s prompt injection. An attacker can trick the agent into ignoring its instructions through:</p><ul><li>Direct injection (&quot;ignore previous instructions&quot;)</li><li>Indirect injection (malicious content in web pages the agent reads)</li><li>Role-playing bypasses (&quot;you are now a free AI&quot;)</li></ul><p>ACIP (Advanced Cognitive Inoculation Prompt) is a system prompt patch that makes agents resistant. It costs nothing (zero runtime overhead) and blocks simple attacks. <a href="https://github.com/Dicklesworthstone/acip" target="_blank" rel="noreferrer">Jeff Emanuel&#39;s ACIP</a> is the reference implementation.</p><h2 id="level-1-2-theatre-skills-system-prompts" tabindex="-1">Level 1-2: Theatre (Skills + System Prompts) <a class="header-anchor" href="#level-1-2-theatre-skills-system-prompts" aria-label="Permalink to &quot;Level 1-2: Theatre (Skills + System Prompts)&quot;">​</a></h2><p>These levels ask the model to behave. They work most of the time on frontier models. But &quot;most of the time&quot; is not a production guarantee. A 99% refusal rate means a 63% failure rate over 100 turns. Use them as accelerators, not enforcement.</p><h2 id="level-3-blacklist-hook" tabindex="-1">Level 3: Blacklist Hook <a class="header-anchor" href="#level-3-blacklist-hook" aria-label="Permalink to &quot;Level 3: Blacklist Hook&quot;">​</a></h2><p>A regex blacklist intercepts dangerous commands before execution. It catches <code>rm -rf /</code> directly. But here&#39;s the marquee break: the agent writes a Python script:</p><div class="language- vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang"></span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span>User prompt: &quot;Clean up the target directory&quot;</span></span>
<span class="line"><span>Agent writes cleanup.py with os.remove() and shutil.rmtree()</span></span>
<span class="line"><span>Agent runs: python cleanup.py</span></span>
<span class="line"><span>Hook sees: &quot;python cleanup.py&quot; (not in blacklist)</span></span>
<span class="line"><span>Result: target/ is destroyed. Blacklist never fired.</span></span></code></pre></div><p>Level 3 is where most engineers stop. It&#39;s not enough.</p><h2 id="level-4-whitelist-hook" tabindex="-1">Level 4: Whitelist Hook <a class="header-anchor" href="#level-4-whitelist-hook" aria-label="Permalink to &quot;Level 4: Whitelist Hook&quot;">​</a></h2><p>Invert the approach. Only N safelisted commands are allowed:</p><div class="language- vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang"></span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span>^npm test$</span></span>
<span class="line"><span>^git status$</span></span>
<span class="line"><span>^uv run pytest</span></span>
<span class="line"><span>^cat [\\w/\\.-]+$</span></span>
<span class="line"><span>^pwd$</span></span></code></pre></div><p>Everything else is blocked. The agent can&#39;t run <code>python cleanup.py</code> because <code>python</code> isn&#39;t on the list. The L3 marquee break is prevented.</p><h2 id="level-5-no-bash" tabindex="-1">Level 5: No Bash <a class="header-anchor" href="#level-5-no-bash" aria-label="Permalink to &quot;Level 5: No Bash&quot;">​</a></h2><p>Bash doesn&#39;t exist. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob, and a capped-output test runner. No shell, no subprocess, no danger.</p><p>This is production-grade. Use it for any agent with access to credentials, customer data, or production infrastructure.</p><h2 id="the-full-stack" tabindex="-1">The Full Stack <a class="header-anchor" href="#the-full-stack" aria-label="Permalink to &quot;The Full Stack&quot;">​</a></h2><p>In production, stack all six:</p><div class="language- vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang"></span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span>L0: ACIP (prompt defense)</span></span>
<span class="line"><span>L1: System prompt rules</span></span>
<span class="line"><span>L2: Safe-mode skill</span></span>
<span class="line"><span>L3: Blacklist hook</span></span>
<span class="line"><span>L4: Whitelist hook</span></span>
<span class="line"><span>L5: No bash, custom tools only</span></span></code></pre></div><p>Each layer catches what the previous one missed. The agent must bypass ALL six to cause damage — not just one.</p><hr><p><em>This is an excerpt from Module 3 of the <a href="/">Agentic Engineering Course</a>. The full module includes runnable lab code for implementing every level.</em></p>`,28)])])}const m=a(o,[["render",l]]);export{u as __pageData,m as default};
