/learn
How to keep an agent safe
One chapter per idea, each opening with an animation. Every frame is computed by the Agent_Loop_Sim engine's policy module, identically in Python and in your browser, over labels, never content. Toggle layers (Concept / Maths / Code) inside any chapter to choose how deep to go. For the wider picture, see the LLM Hub: Agents decks.
An agent drawn as values flowing between the user, the model, its tools and the outside world, each value labelled by where it came from and how secret it is; the boundaries it crosses are where defences go.
Why a model cannot reliably tell data from instructions, from the published research; and what that does to every decision a classic agent makes after it reads something untrusted, against a plan fixed in advance.
Private data, untrusted input and a way to send data out: hold all three and a flow out exists; remove any one and an exhaustive search finds none. One tool can sit in two circles.
Give each task only the tools, scopes and destinations it needs, and tokens bound to one audience: the same plan under a broad grant and under its least privilege, and a call outside the task stopped and explained.
A file-system scope, a container and a network allow-list drawn as boundaries around a tool's process: which actions each layer stops, which it lets through, and the one no layer can see.
Layered, imperfect detectors multiply their misses but never reach zero, and a blind spot they share sets a floor no extra layer removes: attempts drawn one by one through the layers, beside the closed forms and the published rates.
Plan-then-execute and the dual-model pattern: a planner that never reads untrusted data, a quarantined model with no tools, and the policy enforcing every flow; step by step, beside a classic agent.
Approval thresholds, from none to every call, over a suite of benign tasks: prompts per task against the risky actions they gate, and how approval fatigue turns more prompts into less safety.
Every defence's cost (tasks it blocks, prompts, extra calls) against the risk it leaves, on the same benign suite, for fixed attacks and for an attacker who adapts: the security–utility frontier.
Nine checks derived from the chapters, each measured by the engine on a design you choose and linked back to its chapter: labels, routes, the trifecta, least privilege, the sandbox, detection, the plan, prompts and the frontier.