Building a Windows-native ACL sandbox for self-hosted LLM agents (and what still fails)

Description and use

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Problem

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Outcome

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Evidence

Building a Windows-native ACL sandbox for self-hosted LLM agents (and what still fails)

Source