Open-source CBS sandboxes local LLM agents at the OS level, default-denying risky tool calls
Luoriyy · reddit · 2026-11-01
A Reddit developer released Cyber-Butler-Security (CBS, AGPL-3.0), a Windows-native security sandbox that treats LLM agent tool calls like syscalls and default-denies high-risk actions.
Why app-layer defenses failed: plugins can run arbitrary code, so static analysis and keyword blocking are a losing game; asking a model to approve its own actions is expensive and bypassable.
How CBS works:
- Dual-account isolation: the agent (e.g. AstrBot) runs under a separate low-privilege Windows service account; ACLs make desktop files simply invisible to it.
- TOTP broker: file deletion/overwrites in shared workspaces are intercepted by a SYSTEM-level broker requiring a TOTP code from your phone.
- Fail-closed design: if the security layer fails, actions are denied—worst case is a tool error, not a wiped C: drive. No extra LLM tokens are consumed since decisions happen at the OS level.
Honest gaps: the high-security tier is still being verified on clean VMs, and it's not a replacement for Docker/containers on Linux/macOS—just a pragmatic option for Windows users avoiding WSL2.
More from coding & agent
- After Railway credential leak, Every used Codex to triage exposed keys — danshipper · 2026-11-01
- antirez: ablation study needed on whether coding agents do better in C than Rust — antirez · 2026-11-01
- Karpathy builds HackerTube in ~2 hours with zero code: 6,454 HN-recommended videos — minchoi · 2026-11-01
- Solo dev ships Pokemon-like autobattler built almost entirely with Claude Code — columbus3d · 2026-11-01
- vista8 links DeepSeek's article backing the Super-agent architecture thesis — vista8 · 2026-11-01
- AI agents' next bottleneck is humans: people track only 3–5 active sessions — vista8 · 2026-11-01