Building a Windows-native ACL sandbox for self-hosted LLM agents (and what still fails)

Описание и применение

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Задача

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Результат

<p><strong>Disclosure: I used AI to help polish the English in this post. The architecture, code, and testing are my own.</strong></p> <h2> Why I stopped trying to “detect” bad AI behavior </h2> <p>I run a self-hosted LLM agent on Windows (AstrBot + a QQ adapter). Like many people in this space, I started by trying to block dangerous commands at the application layer — regex patterns for <code>rm</code>, <code>del</code>, shell keywords, etc.</p> <p>It didn’t work. A plugin can execute arbitrary code. A prompt injection can rephrase a delete command in a dozen ways. A community member pointed

Доказательства

Building a Windows-native ACL sandbox for self-hosted LLM agents (and what still fails)

Источник