claytonia

This looks less like a model issue and more like a systems design problem.

A vague objective (“make money”) without constraints, budgeting, or basic rules will naturally lead to this kind of behavior. The agent just optimizes whatever it was given. The wage issue is similar.

So the real problem is we’re letting agents make decisions without any real governance (resources, policies, auditing).

Nice project. "Pattern-based injection detection is easily bypassed by obfuscated inputs" is a sharp finding. It got me thinking about two different ways to do agent security.

What you're building is content security: scan the request, decide if it's safe, block it if not. This matters, but it's an arms race. Every rule eventually gets bypassed.

But I think there may be another approach that works at a lower level: don't scan the content at all. Instead, give each agent a set of capability tokens. No token for bash? Can't call bash. No token for file read? Can't read files. Doesn't matter what the prompt says. This is how OS kernels work. You don't check if a syscall looks malicious. You check if the process has the right to make it.

The two actually work at different levels: * Capabilities block whole categories of action. No arms race. But they don't look at content. * Content scanning catches bad stuff within allowed actions. Good for defense in depth.

Most agent security work I see is on the content side. The capability side may be harder to build but it removes the biggest default risk: an agent that can reach any tool, any API, any file by default.

Your OPA integration is an interesting step which may be toward the capability side.

Cool demo, but letting an AI Agent drive a physical probe may have problems. AI is probabilistic, but hardware is precise. If the model miscalculates a pin's position by even 0.1mm, the probe may crush the board. I am curious how the author actually bridges the gap between the Agent’s 'guess' and the sub-millimeter precision needed to avoid damaging hardware?