How to stop prompt injections and AI hallucinations at the OS level (CBS v1.6.2 release)

Cyber-Butler-Security (CBS) is a new OS-level security sandbox designed for Windows, aimed at stopping prompt injections and AI hallucinations. The release v1.6.2-preview introduces several key features.

CBS uses a fail-closed approach, restricting the AI process's physical access to system resources. It isolates the agent in a low-privileged Windows service account, preventing access to host files. A TOTP Broker intercepts high-risk actions, pausing the agent and sending a one-time code to your phone for verification. Scoped tokens limit the agent's permissions to a temporary folder for 30 minutes, blocking any attempts to modify configuration or memory.

The v1.6.2 release addresses three main security traps identified during development. Firstly, it detects intent mismatch where the AI claims to modify a harmless file but actually targets sensitive configuration or secret files. Secondly, it identifies executable content even when files have misleading extensions. Lastly, it prevents tampering with critical integrity files like pytest.ini or conftest.py, and requires a TOTP for any write attempts to these files.

CBS also enhances supply chain security with TOCTOU protection, quarantine for deleted files, WFP egress firewall for auditing outbound connections, and audit hash-chain logging. All logs are mirrored into a hash chain, breaking any tampering attempts. The release is currently experimental, not yet tested on a clean VM or physical machine, and should be used in a disposable VM or snapshot for security researchers.

The Threat Model and Security Policy provide detailed information on CBS's design and limitations. The GitHub repository is available for feedback and contributions.