Keeping the LLM away from the tools: a boundary design that survived injection tests

Revibed69 · reddit · 2026-11-13

An open-source local-LLM app builder follows the rule "AI summarizes, code calculates," validated across six injection-test runs:

The model only composes from a catalog; its output never touches the filesystem, commands, network, or settings writes — each pinned by tests.
Built apps expose four tools: three reads and one save requiring user approval.
Every number in a reply is checked against a tool result, after the model reported a filtered sum as a total.
"Done" lines are computed from spec diffs, never from the model's own summary, since it kept claiming unfinished work.
Injected records got nothing written without approval in all six runs.

Boundary doc and tests are public; the author solicits criticism of the threat model.

More from coding & agent