import{c as a,Q as t,j as s,m as n}from"./chunks/framework.BPKcPtvA.js";const u=JSON.parse('{"title":"The 6-Level Security Ladder","description":"","frontmatter":{},"headers":[],"relativePath":"blog/posts/security-ladder.md","filePath":"blog/posts/security-ladder.md","lastUpdated":1780488246000}'),o={name:"blog/posts/security-ladder.md"};function l(r,e,i,p,c,h){return t(),s("div",null,[...e[0]||(e[0]=[n(`

The 6-Level Security Ladder ​

June 6, 2026

Every AI agent has access to bash. One tool — every dangerous verb: rm -rf, curl, git clean -fdx, terraform destroy, DROP DATABASE.

The math is brutal. At a 1% per-turn failure rate, there's a 63.4% chance of catastrophe over 100 turns. This isn't theoretical — it's the actual threat model for every agent in production.

Most engineers stop at Level 2 (system prompt rules) and think they're safe. They're not. Here's the full 6-level ladder that actually works.

Level 0: ACIP (Prompt Injection Defense) ​

Before bash security, there's prompt injection. An attacker can trick the agent into ignoring its instructions through:

ACIP (Advanced Cognitive Inoculation Prompt) is a system prompt patch that makes agents resistant. It costs nothing (zero runtime overhead) and blocks simple attacks. Jeff Emanuel's ACIP is the reference implementation.

Level 1-2: Theatre (Skills + System Prompts) ​

These levels ask the model to behave. They work most of the time on frontier models. But "most of the time" is not a production guarantee. A 99% refusal rate means a 63% failure rate over 100 turns. Use them as accelerators, not enforcement.

Level 3: Blacklist Hook ​

A regex blacklist intercepts dangerous commands before execution. It catches rm -rf / directly. But here's the marquee break: the agent writes a Python script:

User prompt: "Clean up the target directory"
Agent writes cleanup.py with os.remove() and shutil.rmtree()
Agent runs: python cleanup.py
Hook sees: "python cleanup.py" (not in blacklist)
Result: target/ is destroyed. Blacklist never fired.

Level 3 is where most engineers stop. It's not enough.

Level 4: Whitelist Hook ​

Invert the approach. Only N safelisted commands are allowed:

^npm test$
^git status$
^uv run pytest
^cat [\\w/\\.-]+$
^pwd$

Everything else is blocked. The agent can't run python cleanup.py because python isn't on the list. The L3 marquee break is prevented.

Level 5: No Bash ​

Bash doesn't exist. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob, and a capped-output test runner. No shell, no subprocess, no danger.

This is production-grade. Use it for any agent with access to credentials, customer data, or production infrastructure.

The Full Stack ​

In production, stack all six:

L0: ACIP (prompt defense)
L1: System prompt rules
L2: Safe-mode skill
L3: Blacklist hook
L4: Whitelist hook
L5: No bash, custom tools only

Each layer catches what the previous one missed. The agent must bypass ALL six to cause damage — not just one.

This is an excerpt from Module 3 of the Agentic Engineering Course. The full module includes runnable lab code for implementing every level.

`,28)])])}const m=a(o,[["render",l]]);export{u as __pageData,m as default};