{
  "id": 17882096,
  "title": "How to stop prompt injections and AI hallucinations at the OS level (CBS v1.6.2 release)",
  "url": "https://urgent.news/2026/11/03/how-to-stop-prompt-injections-and-ai-hallucinations-at-the-os-level",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-03T00:53:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/_9439daaf10225d6b438d6/how-to-stop-prompt-injections-and-ai-hallucinations-at-the-os-level-cbs-v162-release-21b6"
  },
  "original_language": "en",
  "account": "Cyber-Butler-Security (CBS) is a new OS-level security sandbox designed for Windows, aimed at stopping prompt injections and AI hallucinations. The release v1.6.2-preview introduces several key features.\n\nCBS uses a fail-closed approach, restricting the AI process's physical access to system resources. It isolates the agent in a low-privileged Windows service account, preventing access to host files. A TOTP Broker intercepts high-risk actions, pausing the agent and sending a one-time code to your phone for verification. Scoped tokens limit the agent's permissions to a temporary folder for 30 minutes, blocking any attempts to modify configuration or memory.\n\nThe v1.6.2 release addresses three main security traps identified during development. Firstly, it detects intent mismatch where the AI claims to modify a harmless file but actually targets sensitive configuration or secret files. Secondly, it identifies executable content even when files have misleading extensions. Lastly, it prevents tampering with critical integrity files like pytest.ini or conftest.py, and requires a TOTP for any write attempts to these files.\n\nCBS also enhances supply chain security with TOCTOU protection, quarantine for deleted files, WFP egress firewall for auditing outbound connections, and audit hash-chain logging. All logs are mirrored into a hash chain, breaking any tampering attempts. The release is currently experimental, not yet tested on a clean VM or physical machine, and should be used in a disposable VM or snapshot for security researchers. The Threat Model and Security Policy provide detailed information on CBS's design and limitations. The GitHub repository is available for feedback and contributions.",
  "summary": "Disclosure: I am the author of Cyber-Butler-Security (CBS). If you run AI Agents (like DeepSeek Harness, AstrBot, or LangChain) locally on your machine, you've probably experienced the \"Oh no\" moment. Maybe the AI hallucinated and deleted a folder. Maybe a malicious prompt injected through a webpage told the agent to read your ~/.ssh keys. Most solutions today try to fix this at the application…",
  "key_points": [
    "CBS uses fail-closed approach to restrict AI access to system resources",
    "TOTP Broker intercepts high-risk actions for verification",
    "v1.6.2 release addresses intent mismatch, executable content, and critical file tampering"
  ],
  "editors_take": "Moving AI security from the application layer to the operating system level shifts the burden of defense toward hardware-level isolation and strict permission controls to prevent autonomous agents from compromising host files.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}