Autonomous Loop Security|INEMA.CLUB-PRO

LOOP-R Engineering Track · course 4 of 6 · 8 lessons

Autonomous Loop Security: an agent that runs on its own can't have everything at once

Lethal trifecta, Rule of Two, injection through the content it reads, per-step permissions, guard hooks, a proven sandbox, a gate for the irreversible, and an audit of your loop. Defense for people who run their own agents, with local rehearsals that don't use your quota.

Start with lesson 1 See the track page
Dark server room with a rack behind a glass door locked with a small padlock.
  • 8lessons
  • 23exercises with expected output
  • 11local rehearsals, no model calls
  • 3real steps, one call each

The lessons

In the order you close the doors: map the risk, limit what each session combines, see the injection, permissions, hooks, sandbox, the irreversible, and the audit.

  1. Lesson 1 · 15 minThe lethal trifecta: private data, untrusted content, an outbound channelAn agent that reads private data, reads text written by anyone, and can send something out can be commanded by whoever wrote that text. The name comes from Simon Willison. In this lesson you map your loop's sessions onto the three legs and cut one where all three meet.
  2. Lesson 2 · 15 minRule of TwoThe trifecta is about leaking. The Rule of Two, published by Meta, is also about damage: an agent that reads outside text, sees what is sensitive, and can change things can be commanded even without a network. In this lesson you fail a loop that passes the trifecta and split it until each session has at most two.
  3. Lesson 3 · 20 minInjection through the content the agent readsInjection doesn't come from whoever talks to the agent: it comes from what the agent reads. Text hidden in a page, invisible to you, is ordinary text to the model. In this lesson a fake agent, one that obeys the way the worst model would, reads a poisoned page on your machine, and a canary shows where the secret left.
  4. Lesson 4 · 20 minPermissions per step: capabilities and policyPlan only reads. Execute edits the code and runs the tests. Review reads and runs the tests. If all three steps run with the same permission, the whole loop has the permission of the most dangerous one. In this lesson each step gets its own settings.json in Claude Code and its own -s in Codex, and you see where a deny rule lets things through.
  5. Lesson 5 · 20 minHooks as a guard: before the tool, against deleting and collidingA permission rule compares text; a hook runs code before every tool and can look at the disk. In this lesson you turn on three PreToolUse guards: one denies the irreversible and the judge's files, another shows how many files an rm would delete and asks for confirmation, and the third warns when another session touched the same file.
  6. Lesson 6 · 20 minNetwork and file sandboxA rule and a hook read the command; the sandbox reads nothing: the operating system simply won't let the process write outside the folder or open the network. But a sandbox can also fail silently. In this lesson you prove, with four escape attempts, what holds on your machine, and you see two locks that did not hold on this one.
  7. Lesson 7 · 20 minIrreversible needs a human; run outside the terminal without increasing the blast radiusSending, publishing, deleting, and spending can't be undone. In the loop, these actions become requests that wait at a gate that only you open, seeing the destination and content. And when the loop leaves the terminal for systemd, it takes the cap, the sandbox, and the gate with it, not your whole session.
  8. Lesson 8 · 20 minSecurity audit of your loopEverything the course built fits in one file: the map of your loop's sessions, with each session's tools and controls. auditar.py reads the map, checks the trifecta, the Rule of Two, permissions, guard, proven isolation, network, gate and caps, and writes the checklist of what's missing. You fix it, audit again and set the next review.

Who it's for

  1. 1People who run Claude Code or Codex on their own for hours, in a loop, cron or systemd, on their own projects.
  2. 2People who gave the agent access to read issues, pages or emails and access to the repository at the same time.
  3. 3People who want to know, with proof, what the agent can and can't do on their own machine.

What you'll be able to do

  1. 1Map each loop session onto the three legs of the trifecta and the Rule of Two, and cut where it closes.
  2. 2Separate whoever reads outside content from whoever holds the secret, and catch a leak with a canary.
  3. 3Write deny rules per step, turn on hooks that deny the irreversible, and prove the sandbox holds.
  4. 4Put sending, push and deleting behind a human gate and audit the loop with a dated checklist.

Before you start

  1. 1Linux with git, Python 3 and Node. macOS works for almost everything; the sandbox and systemd proofs are Linux-only.
  2. 2Claude Code and Codex signed in through your subscription, only for the steps marked "real".
  3. 3Recommended: course 0 (Foundations). Course 2 (Long Runs) runs the loop that this course protects.