← Selected work

Research area

Agent security research

Agent security here means two concrete things: whether a person can actually authorize what an AI agent does, and whether anyone can check afterward what it did. I study both by building the controls and measuring the record they leave. Every claim below links to working code, a published dataset, or a public issue.

Start with the failure modes ↓ See what is still open

Four failure modes, four existing artifacts

Each of these is a way agent work goes wrong in practice, paired with the thing on this site that addresses or measures it. The scope line under each one is the limit of what that artifact shows.

Agent actions that were never specifically approved

A blanket “yes” does not survive the agent changing its command afterward. BigBoss makes approval refer to one specific proposal: the proposed action, its workspace, and the policy version are hashed into an action_hash, and the adapter contract requires the executed action to match the hash that was returned. Policy routing decides what is automatically allowed, what enters review, and what is blocked — structured read-only actions can proceed, while file changes and shell commands enter review under the default policy. Decisions and events persist in SQLite, so the record outlives the terminal session that produced it.

Scope: enforcement depends on an integrated adapter honoring the contract. BigBoss is an approval workflow, not a complete sandbox for arbitrary processes on the machine. It is a personal working MVP with one human authority per instance, and no productivity or external-adoption result is claimed for it.

Policy implementation approval store read the case study

Agent-written code that reaches a codebase unreviewed

To argue about review coverage for agent-written code you need a record of what landed and who signed off. Throughput is not progress is an author-run census of 1,979 PR-linked commits on one pinned repository, recording file composition, whose identity survived the merge, and which pull requests carried a GitHub review. The kill bar was set before the run: below 80% coverage of GitHub-merged pull requests the instrument would have been discarded. Observed coverage was 1,979 / 2,338 = 84.6%, so the instrument stands, and the 15.4% gap is not imputed.

Scope: the estimand is composition and identity, not merge rate, and none of it is a causal claim. The file-shape labels describe bytes, not value. One repository, one operator, one pinned commit.

Codebook dataset and pre-registration read the study

A model that grades its own output

Asking one model whether its own answer is right is a weak check, and agreement between two runs of the same model is weaker still. The Council separates answering, peer critique, claim checking, and synthesis across model providers, and keeps each stage inspectable rather than asking you to trust the final text. Verifier selection prefers an author different from the one that produced the claim.

Scope: in a single-provider configuration, verification falls back to the same author. Peer ratings are model judgments, not measured correctness. One inspected live trajectory is an illustration, not a general accuracy benefit.

Application repository a recorded run read the case study

Desktop agents and host access control

Agent tooling runs on a host with its own permission model, so a packaged desktop application that stops launching after it exits is an access-control question before it is a support question. Two author-run studies track a recursive two-SID profile ACL treatment through grant, withdrawal, and reinstatement on one Windows 11 workstation, scoring cold-launch outcome and AppModel-Runtime events: Claude Desktop in a B-A-B sequence, where withdrawal produced Event 208 with 0x80070005 at LaunchProcess, and ChatGPT Desktop, where an observed failed baseline preceded the controlled sequence.

Scope: n = 1 machine and one package each. Same-host consistency across two packages is not independent replication. The ACL command is an experimental intervention, not a validated general repair. Mechanism and prevalence are unknown.

anthropics/claude-code#94384 openai/codex#45511 raw reversal record

Open questions

These are open. None of them has an answer on this site, and each one names the check that would settle it.

  1. What does an approval gate protect when the adapter is not there?

    BigBoss binds a decision to a hashed proposal, but a harness that never submits the proposal is outside the gate entirely. How much of an agent’s action surface a workflow-level gate can actually cover is unresolved, as is which parts belong to a sandbox instead. Settling it means enumerating the action surface of one harness and measuring what fraction reaches the gate.

  2. Does unreviewed agent code cost anything measurable?

    The census counted review coverage. It did not follow those pull requests to defects, reverts, or incidents, and it makes no causal claim. Linking composition to outcome needs a different instrument and a repository where outcomes are observable after the merge.

  3. How much independence does cross-vendor checking actually buy?

    The Council prefers a different author for verification, but nothing published here measures how often that changes the verdict compared with an author-checks-itself configuration. That is an A/B design on a fixed question set, not an argument.

  4. Are the Windows ACL entries a cause or a correlate?

    One machine, one treatment, one scored launch per phase, mechanism untested. What would settle it is the same withdrawal-and-reinstatement sequence run on independent hosts by someone other than the author.

What this is and is not

Simone Systems Research conducts agent-security research and builds human-control tooling, published as open code and open data. It is not a security firm. There is no client work, no external engagement, no accreditation, no credited vulnerability disclosure, and no offensive-testing service here, and none is claimed.

Everything above points at a repository, a dataset, or a public issue. Where the evidence is one machine or one repository, the page says so in the same paragraph as the finding.

Explore the work

Independent work by Jonathan Simone, developed with AI assistance. Each linked page states its own evidence and limits.