Deny Lists Don’t Work

If you read social media posts about how to add some safety to your LLM agent harness configuration, you’ll often see people proposing editing the settings with deny lists like:

If tool is Bash, and command matches rm -rf / then Block.

There are many problems with this approach like these valid variations:

• rm -fr /
• rm --force -r /
• rm --recursive -ff /

However, that only scratches the surface. Then there’s bash -c "rm -rf /", or the Python, PERL, Ruby, etc. equivalent. Or writing a C program, compiling it, and running that binary to the same effect. Deny lists don’t work. Especially for agents. An unmotivated human might try a common command evocation, get a block and then stop. An agent can search for every possible way to perform an action very quickly if it has decided that is what needs to be done.

The Wrong Idea

Trying to recognize and stop every potentially dangerous action an agent could theoretically take is the wrong idea. The better question is “What is the maximum damage the agent’s capabilities permit?” We’ve worked this problem before and the answer is not pattern matching. Instead look at process namespace isolation, containers or virtual machines, network policies, least-privilege credentials, etc. Built security around the agent, outside of anything it can control or change. If it’s possible for an agent to change a control, then it’s not a control.

Agent Specific Problem

As LLMs become more capable, brittle security policy becomes weaker. A security mechanism whose effectiveness depents on the agent not realizing there is another way gets less reliable as models improve. A real security boundary remains effective independently of what software is being used.

Wrap-up

So when looking at LLM agent harness security, don’t be overly focused on whatever settings the harness provides. Think more broadly. Use the security practices we already know to isolate, limit, and minimize authority, capability, access, and connectivity. As an added benefit, much of these bigger-picture security practices will apply to any agent harness instead of being bespoke for one piece of software.