Cyber-Butler-Security（CBS）如何在作業系統層面防止提示詞注入與模型幻覺（v1.6.2-preview 發佈）

Disclosure: I am the author of Cyber-Butler-Security (CBS).

If you run AI Agents (like DeepSeek Harness, AstrBot, or LangChain) locally on your machine, you've probably experienced the "Oh no" moment.

Maybe the AI hallucinated and deleted a folder. Maybe a malicious prompt injected through a webpage told the agent to read your ~/.ssh keys.

Most solutions today try to fix this at the application layer: writing better prompts, hooking into the agent's API, or using a secondary LLM to judge the first LLM.

But here is the harsh truth I learned after talking to security experts on Reddit: You can't stop a Turing-complete program by asking it nicely.

If the agent executes arbitrary code, application-layer guardrails are just suggestions. So, I decided to build Cyber-Butler-Security (CBS) — an OS-level, fail-closed security sandbox specifically designed for Windows.

Today, I am releasing v1.6.2-preview (Experimental). Here is how it works, the new features, and the three deadly traps we had to build defenses for.

🏗️ The Core Philosophy: Fail-Closed & Human-in-the-Loop

CBS doesn't try to judge if the AI is "good" or "bad". It restricts what the process is physically allowed to touch.

1. Dual-Account Isolation: The Agent runs in a separate low-privileged Windows service account (CyberButlerSvc). It physically cannot see your host files via Windows ACLs.
2. TOTP Broker: If the Agent tries a high-risk action (delete/overwrite), the SYSTEM-level Broker intercepts it. It pauses the Agent and sends a TOTP (Time-based One-Time Password) to your phone. The AI cannot see or intercept this code.
3. Scoped Tokens: To prevent approval fatigue, you can authorize a specific scratch folder for 30 minutes. The AI works freely there, but the moment it touches config or memory, it gets blocked again.

⚠️ The 3 Deadly Traps We Had to Defend Against

During development and discussions with red-teamers, we realized that simple "file path blocking" is not enough. Here are the new defenses in v1.6.2:

Trap 1: The "Lying" AI (Intent Mismatch)

The problem: The AI says, "I'm just updating the UI colors," but the actual tool call is trying to modify .env or auth.py. If a human blindly clicks "Approve" on the TOTP prompt, the system is compromised.
The fix: CBS compares the AI's reason string with the actual target path. If it claims to modify UI/CSS but touches config/secret, the TOTP prompt flashes a huge red ⚠️ INTENT MISMATCH warning. We show the raw system parameters, never the AI's natural language summary.

Trap 2: The "Wolf in Sheep's Clothing" (Magic Bytes Sniffing)

The problem: A malicious script can be renamed to travel_photo.txt. Simple extension-based filtering will miss it.
The fix: CBS reads the first few bytes of the payload. If it detects a Shebang (#!), PE (MZ), or ELF header, it flags the file as Executable Content, regardless of the extension.

Trap 3: Test Tampering & Rule Bypassing (Anti-Tampering)

The problem: If you use AI to write code, it might modify pytest.ini or conftest.py just to make the CI pipeline pass, rather than actually fixing the code.
The fix: CBS hard-denies (403) any write attempts to critical integrity files (conftest.py, pytest.ini, .github/workflows/*). We also introduced a Credential Proxy: the Agent only gets a "fake" API key. The real key is injected at the local reverse proxy layer. Even if the AI is compromised, it cannot steal your real credentials.

🛡️ Supply Chain Security & Auditability

We also hardened the release and audit process:

• TOCTOU Protection: Approvals are bound to the file handle + SHA-256. If the file is swapped between approval and execution, CBS returns a 409 Conflict.
• Quarantine: Deleted files go to an isolated zone with a manifest. Restoring them requires a new TOTP.
• WFP Egress Firewall: We use Windows Filtering Platform (WFP) to audit and block outbound connections. (Currently in audit-only mode to prevent false positives).
• Audit Hash-Chain: All logs are mirror-written into a hash chain. Tampering with the logs breaks the chain.
• RSA-3072 Signed Releases: The release manifest is cryptographically signed.

🚨 A Critical Warning (Please Read)

CBS v1.6.2-preview is an EXPERIMENTAL release.
It has not completed clean-VM acceptance or full physical-machine testing yet.

• If you want a working setup: Please download the stable v1.6.1 release.
• If you are a security researcher/bug hunter: This v1.6.2 preview is for you. Please run it in a disposable VM or snapshot.

We have published our Threat Model and Security Policy (SECURITY.md). It includes our core security invariants, a self-audit checklist inspired by CVE-2026-82533 (the local API auth bypass in AI harnesses), and a list of what CBS explicitly does not protect against (like a full admin compromise).

🔗 Repo & Feedback

GitHub: https://github.com/JunxiangPan/Cyber-Butler-Security

We have 154 passed Pytest cases and 144 passed Pester tests, but I know there are gaps.
If you test it, let me know:

1. Does the Intent Mismatch logic cause false positives?
2. Are there ways to bypass the Magic Bytes sniffing?
3. Does the TOTP Broker ever hang or deadlock under heavy concurrency?

Let's build a safer ecosystem for local AI together. Thanks for reading!