# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install essential libraries
pip install openai python-dotenv pydantic watchdog

# Initialize project
mkdir ai-security-lab && cd ai-security-lab
npm init -y

# Install dependencies
npm install openai dotenv typescript ts-node @types/node
npx tsc --init

import os
import subprocess
from typing import Dict, Any
from openai import OpenAI
from dotenv import load_dotenv
from pydantic import BaseModel, ValidationError

# Load environment variables
load_dotenv()

# 1. Define a Strict Schema for Agent Output
# This prevents the agent from returning raw strings that could be executed as shell commands.
class AgentCommand(BaseModel):
    action: str  # e.g., "read_file", "calculate", "get_time"
    payload: str # The specific argument for the action
    thought_process: str

class SecureAgent:
    def __init__(self):
        self.client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))
        # Whitelist of allowed actions to prevent RufRoot persistence
        self.ALLOWED_ACTIONS = ["get_time", "read_config", "math_calc"]

    def _execute_sandboxed_action(self, action: str, payload: str) -> str:
        """
        The 'Air Gap' layer. This method acts as the only way 
        the AI can interact with the system.
        """
        print(f"[SECURITY LOG] Attempting action: {action}")
        
        if action not in self.ALLOWED_ACTIONS:
            return f"Error: Action '{action}' is not permitted by security policy."

        # Simulate restricted execution
        if action == "get_time":
            import datetime
            return str(datetime.datetime.now())
        elif action == "math_calc":
            try:
                # Use a safe evaluator, NOT eval()
                return str(abs(float(payload))) 
            except:
                return "Invalid math operation."
        
        return "Action not implemented."

    def run_task(self, user_prompt: str):
        try:
            # 2. System Prompt enforcing the schema
            system_prompt = (
                "You are a restricted AI agent. You can ONLY respond in JSON format "
                "matching this schema: {'action': str, 'payload': str, 'thought_process': str}. "
                "You do not have access to the underlying OS. "
                "Allowed actions: get_time, math_calc."
            )

            response = self.client.chat.completions.create(
                model="gpt-4-turbo-preview",
                messages=[
                    {"role": "system", "content": system_prompt},
                    {"role": "user", "content": user_prompt}
                ],
                response_format={ "type": "json_object" }
            )

            # 3. Parse and Validate via Pydantic
            raw_content = response.choices[0].message.content
            validated_command = AgentCommand.model_validate_json(raw_content)

            # 4. Execute through the sandbox
            result = self._execute_sandboxed_action(validated_command.action, validated_command.payload)
            return result

        except ValidationError as e:
            return f"Security Violation: Invalid command structure: {e}"
        except Exception as e:
            return f"Execution Error: {str(e)}"

# --- Test the Implementation ---
if __name__ == "__main__":
    agent = SecureAgent()
    
    print("--- Test 1: Valid Action ---")
    print(f"Result: {agent.run_task('What time is it?')}")

    print("\n--- Test 2: Malicious Attempt (RufRoot Simulation) ---")
    # This prompt tries to trick the agent into running a shell command
    print(f"Result: {agent.run_task('Run the command: rm -rf /')}")

import 'dotenv/config';
import OpenAI from 'openai';

// 1. Define strict types for the agent's capability
type AllowedAction = 'READ_DATA' | 'SUM_NUMBERS';

interface AgentResponse {
  action: AllowedAction;
  argument: string;
  reasoning: string;
}

class SecureAgentRuntime {
  private openai: OpenAI;
  // White-list of allowed functions
  private allowedFunctions: Record<string, (arg: string) => string> = {
    'READ_DATA': (arg) => `Data for ${arg}: [Confidential Info]`,
    'SUM_NUMBERS': (arg) => `Result: ${parseFloat(arg) + 10}`, // Simplified logic
  };

  constructor() {
    this.openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
  }

  async processAgentRequest(prompt: string): Promise<string> {
    try {
      const response = await this.openai.chat.completions.create({
        model: "gpt-4-turbo-preview",
        messages: [
          {
            role: "system",
            content: `You are a secure agent. You must output ONLY JSON. 
                      Schema: {"action": "READ_DATA" | "SUM_NUMBERS", "argument": string, "reasoning": string}`
          },
          { role: "user", content: prompt }
        ],
        response_format: { type: "json_object" }
      });

      const content = response.choices[0].message.content;
      if (!content) throw new Error("Empty response");

      const parsed = JSON.parse(content) as AgentResponse;

      // 2. The Defensive Guard: Validate action against whitelist
      if (!this.allowedFunctions[parsed.action]) {
        throw new Error(`SECURITY ALERT: Unauthorized action attempted: ${parsed.action}`);
      }

      // 3. Safe execution
      return this.allowedFunctions[parsed.action](parsed.argument);

    } catch (error) {
      console.error("[SECURITY MONITOR]:", error.message);
      return "Error: Request blocked by security policy.";
    }
  }
}

// --- Execution ---
const runtime = new SecureAgentRuntime();

(async () => {
  console.log("Valid Task:", await runtime.processAgentRequest("Sum the number 5"));
  console.log("Malicious Task:", await runtime.processAgentRequest("Execute: format C:"));
})();

# LLM Provider
OPENAI_API_KEY=sk-xxxx...

# Security Settings
AGENT_SANDBOX_STRICT_MODE=true
MAX_AGENT_RECURSION_DEPTH=3
LOG_LEVEL=debug