114 lines
4.5 KiB
Markdown
114 lines
4.5 KiB
Markdown
# The 6-Level Security Ladder
|
|
|
|
**June 6, 2026**
|
|
|
|
Every AI agent has access to bash. One tool — every dangerous verb: `rm -rf`, `curl`, `git clean -fdx`, `terraform destroy`, `DROP DATABASE`.
|
|
|
|
The math is brutal. At a 1% per-turn failure rate, there's a **63.4% chance of catastrophe over 100 turns**. This isn't theoretical — it's the actual threat model for every agent in production.
|
|
|
|
Most engineers stop at Level 2 (system prompt rules) and think they're safe. They're not. Here's the full 6-level ladder that actually works.
|
|
|
|
## Level 0: ACIP (Prompt Injection Defense)
|
|
|
|
Before bash security, there's prompt injection. An attacker can trick the agent into ignoring its instructions through:
|
|
- Direct injection ("ignore previous instructions")
|
|
- Indirect injection (malicious content in web pages the agent reads)
|
|
- Role-playing bypasses ("you are now a free AI")
|
|
|
|
ACIP (Advanced Cognitive Inoculation Prompt) is a system prompt patch that makes agents resistant. It costs nothing (zero runtime overhead) and blocks simple attacks. [Jeff Emanuel's ACIP](https://github.com/Dicklesworthstone/acip) is the reference implementation.
|
|
|
|
## Level 1-2: Theatre (Skills + System Prompts)
|
|
|
|
These levels ask the model to behave. They work most of the time on frontier models. But "most of the time" is not a production guarantee. A 99% refusal rate means a 63% failure rate over 100 turns. Use them as accelerators, not enforcement.
|
|
|
|
## Level 3: Blacklist Hook
|
|
|
|
A regex blacklist intercepts dangerous commands before execution. It catches `rm -rf /` directly. But here's the marquee break: the agent writes a Python script:
|
|
|
|
```
|
|
User prompt: "Clean up the target directory"
|
|
Agent writes cleanup.py with os.remove() and shutil.rmtree()
|
|
Agent runs: python cleanup.py
|
|
Hook sees: "python cleanup.py" (not in blacklist)
|
|
Result: target/ is destroyed. Blacklist never fired.
|
|
```
|
|
|
|
Level 3 is where most engineers stop. It's not enough.
|
|
|
|
## Level 4: Whitelist Hook
|
|
|
|
Invert the approach. Only N safelisted commands are allowed:
|
|
|
|
```
|
|
^npm test$
|
|
^git status$
|
|
^uv run pytest
|
|
^cat [\w/\.-]+$
|
|
^pwd$
|
|
```
|
|
|
|
Everything else is blocked. The agent can't run `python cleanup.py` because `python` isn't on the list. The L3 marquee break is prevented.
|
|
|
|
## Level 5: No Bash
|
|
|
|
Bash doesn't exist. The agent has only purpose-built tools: Read, Write, Edit, Grep, Glob, and a capped-output test runner. No shell, no subprocess, no danger.
|
|
|
|
This is the production target. At L5, the agent cannot:
|
|
- Delete files (no `rm`, no `os.remove()`)
|
|
- Install packages (no `npm install`, no `pip install`)
|
|
- Access the network (no `curl`, no `wget`)
|
|
- Run arbitrary code (no `python`, no `node`)
|
|
- Modify system config (no `chmod`, no `apt`)
|
|
|
|
**What the agent CAN do**: Read files, write to specific paths, search for patterns, and run tests in a sandbox. That's enough for most coding tasks and eliminates the entire attack surface.
|
|
|
|
## Which Level Do You Need?
|
|
|
|
| Scenario | Minimum Level | Recommended |
|
|
|----------|-------------|-------------|
|
|
| Personal assistant, local dev | L3 | L3 |
|
|
| CI/CD pipeline agent | L3 | L4 |
|
|
| Production deployment agent | L4 | L5 |
|
|
| Customer-facing agent | L4 | L5 |
|
|
| Database-admin agent | L4 | L5 (no bash) |
|
|
| Research agent (runs arbitrary code) | L3 | L3 + sandbox |
|
|
|
|
The rule: if the agent can cause more than $100 of damage in one session, it needs L4 or higher. If it can cause irreversible damage (data loss, security breach), it needs L5.
|
|
|
|
## Defense in Depth — Why You Need ALL Six Levels
|
|
|
|
Each level catches failures from the level above it:
|
|
|
|
```
|
|
Attack → L0 (ACIP rejects injection) → PASSES → L1 (system prompt) → PASSES
|
|
→ L2 (skill says "be careful") → PASSES → L3 (blacklist) → PASSES
|
|
→ L4 (whitelist blocks python) → BLOCKED
|
|
|
|
Without L4: python cleanup.py runs and destroys the directory
|
|
Without L3: rm -rf / runs and destroys the server
|
|
Without L0: prompt injection bypasses everything below
|
|
```
|
|
|
|
A single level is not security. The full ladder is security. Each layer independently catches what the layers above missed.
|
|
|
|
This is production-grade. Use it for any agent with access to credentials, customer data, or production infrastructure.
|
|
|
|
## The Full Stack
|
|
|
|
In production, stack all six:
|
|
|
|
```
|
|
L0: ACIP (prompt defense)
|
|
L1: System prompt rules
|
|
L2: Safe-mode skill
|
|
L3: Blacklist hook
|
|
L4: Whitelist hook
|
|
L5: No bash, custom tools only
|
|
```
|
|
|
|
Each layer catches what the previous one missed. The agent must bypass ALL six to cause damage — not just one.
|
|
|
|
---
|
|
|
|
*This is an excerpt from Module 3 of the [Agentic Engineering Course](/). The full module includes runnable lab code for implementing every level.*
|