<p>I had Claude credits left in my week and wanted to secure my agent-dediced macbook. It
ran on my Mac M1
for a few days while I was on vacation. I made it kind of fancy with Discord support and
remote management through tailscale, it was really fun getting notified every now and
then that another commit was pushed to the open PR.</p>
<p>It used a DIY mvp version of a <a href="https://github.com/snarktank/ralph">Ralph loop</a>.
I am the supply chain! ...The bots tell me they won't draw Simpsons characters for me
and I'm not about to break out an image editor, so we get this footless child instead.</p>
<p>Look at the commits in <a href="https://github.com/kylep/multi/pull/52">this PR</a>, over 80!
A common thing about AI is you get all these impressive stats that way oversell the value
that they represent. These 80 commits are cool but if I'd done it by hands it would have
been like... 4, maybe 5.</p>
<p>As another win, I used my PRD and DD agents from the
<a href="/ai-native-sdlc-first-try.html">prior post</a> to design this out and
that worked wonderfully.</p>
<h2 id="ralph">Ralph?</h2>
<p>Ralph is an autonomous agent pattern that runs Claude Code in a loop
until a task list is empty. The task list here was dynamic, Claude kept looking for new
ways to improve laptop security without hurting agent autonomy. Later it crunched
through security findings from compliance scanners. The agent read each
finding, fixed it through Ansible, verified the fix, and
moved to the next one. I steered it from Discord a bit.</p>
<h1 id="the-setup">The setup</h1>
<p>The machine is a Mac M1 running as an AI workstation. This is "Claude's laptop", and I
factory reset it to remove anything Claude shouldn't have. I segmented it from my
network too, just in case.</p>
<p>Claude Code runs in bypass-permissions mode with
unrestricted tool access. The entire machine config is managed
by an <a href="https://github.com/kylep/multi/tree/main/infra/mac-setup">Ansible playbook</a>,
so any change the agent makes is reproducible on a fresh
install.</p>
<p>Before this project, I'd done some security work setting up pre-commit hooks for
semgrep and gitleaks, a <a href="/ai-security-toolkit.html">security toolkit</a> Docker image, and
hook scripts that blocked known-bad commands.</p>
<h1 id="loop-claude-go-do-security">Loop: Claude, go "do security"</h1>
<p>This loop was <em>okay, I guess</em>. The idea of the loop is really exciting. I can't wait to
get a loop of, like "work on anything in Linear" or something similarly broad that is
able to decompose stuff properly.</p>
<p>Anyways, for this project, the focus was limited to laptop security.
A Python script spawns Claude Code every few minutes to keep in the 5-hour token window.
We never really went above 50%. I had a custom token use mcp counting things up too,
but the math is fuzzy, especially since Claude was offering double quota at night that
week.</p>
<p>Each iteration:</p>
<ol>
<li>Tries to find something to do to improve security (tool or LLM decides)</li>
<li>Pick a finding that hasn't been attempted</li>
<li>Fix it through the Ansible playbook (not ad-hoc shell)</li>
<li>Run the playbook to deploy the fix</li>
<li>Verify the fix took effect</li>
<li>Commit and push</li>
</ol>
<pre class="mermaid">
stateDiagram-v2
    [*] --> Ideate
    Ideate --> PickFinding
    PickFinding --> FixInPlaybook
    FixInPlaybook --> Deploy
    Deploy --> Verify
    Verify --> Commit: pass
    Verify --> PickFinding: fail (retry)
    Commit --> Sleep
    Sleep --> ReadLog
</pre>
<p>The loop had those cost/token controls, a lock file so
only one instance ran at a time, and a timeout per
phase to kill things when they get stuck. It had an adversarial subagent loop, I love those, to
make sure that the changes actually worked, helped security, and did not hurt agent autonomy.
It pushed to GitHub and pinged me on Discord after each verified commit, so I could review from my phone.</p>
<h2 id="llm-only-no-tools">LLM only, no tools</h2>
<blockquote>
<p>"Claude, find me some ways to make my laptop secure and implement the best one through Ansible".</p>
</blockquote>
<p>It found a few real, if basic, issues. Things like:</p>
<ul>
<li>The application firewall was off</li>
<li>A <code>sudoers.d</code> file granted passwordless sudo to the agent user</li>
<li><code>exports.sh</code> and <code>.mcp.json</code> were world-readable (mode 0644)</li>
<li>Screen lock wasn't configured</li>
</ul>
<p>But 60 iterations later, most of the time had gone to things that didn't matter or couldn't work.</p>
<h2 id="the-loop-gets-stuck">The loop gets stuck</h2>
<p>It turns out you need to be proactive about preventing loops.</p>
<p>During this test, Claude spent multiple days iterating on a hook script called <code>protect-sensitive.sh</code>.
It'd move on then just keep coming back for it. The hook itself just tried to prevent the agent from reading sensitive files.
I had given some instructions to not get stuck in loops like that, but I guess it didn't take.</p>
<h2 id="explain-yourself-claude-agent-rcas">Explain Yourself, Claude: Agent RCAs</h2>
<p>After 68 commits in the week, I had Claude run an RCA.</p>
<blockquote>
<p>LLM intuition is a weak security discovery mechanism. The
loop should execute against a scanner's scored finding list,
not improvise the list itself.</p>
</blockquote>
<p>The result Looked really good, 68 commits in 3 days is cool stat, but the actual value
delivered was pretty meh. You need to be really intentional and good about goal-setting.</p>
<p>The RCA asked if it could just use a scanner like I did with the SCA stuff and that
immediately resulted in way more fixes and a much better loop.</p>
<h1 id="scanner-driven-task-lists-are-way-better">Scanner-driven task lists are way better</h1>
<p>The RCA recommended three scanners:</p>
<table>
<thead>
<tr>
<th>Tool</th>
<th>Scope</th>
<th>Why</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="https://cisofy.com/lynis/">Lynis</a></td>
<td>General system audit</td>
<td>Broad, scored, Linux-first but works on macOS</td>
</tr>
<tr>
<td><a href="https://rkhunter.sourceforge.net/">rkhunter</a></td>
<td>Rootkit detection</td>
<td>Catches things Lynis doesn't check</td>
</tr>
<tr>
<td><a href="https://github.com/usnistgov/macos_security">mSCP</a></td>
<td>macOS CIS Level 1</td>
<td>NIST-maintained, macOS-native compliance checks</td>
</tr>
</tbody>
</table>
<p>All three install through the Ansible playbook. A LaunchDaemon
runs them daily at 06:00 and writes results to
<code>/var/log/security-scans/</code>.</p>
<p>It was admittedly kind of a pain in the ass to help Claude escalate perms to root over
and over during the mSCP thing, some of those tests need root to run and Claude couldn't
trigger them itself.</p>
<h1 id="whatd-it-get-me">What'd it get me?</h1>
<p>Other than the fun of having it work while I was away, here's what Claude tells me it
implemented to secure my laptop from this. Worth noting that this was all done through
Ansible, so when I factory reset my laptop again (I will), I get this back too:</p>
<ul>
<li>Enabled the macOS application firewall and stealth mode to block unsolicited inbound connections</li>
<li>Enabled Gatekeeper to enforce code signing and notarization on all executables</li>
<li>Disabled SSH root login and enforced protocol v2 only</li>
<li>Locked down <code>sshd_config</code> permissions (0600) so it can't be read by other users</li>
<li>Set screen lock to trigger after 10 minutes idle, requiring password immediately</li>
<li>Disabled the guest account entirely</li>
<li>Disabled automatic login</li>
<li>Removed password hints from the login window</li>
<li>Enabled automatic app updates</li>
<li>Disabled AirDrop to prevent unsolicited file transfer attempts</li>
<li>Disabled AirPlay receiver so the machine can't accept screen share requests</li>
<li>Disabled Siri data sharing and search query telemetry</li>
<li>Disabled assistive voice data donation</li>
<li>Disabled diagnostic report submission to Apple</li>
<li>Disabled AI writing tools, mail summaries, Notes transcription, and external intelligence integrations</li>
<li>Disabled personalized advertising</li>
<li>Forced on-device-only dictation (no audio sent to Apple servers)</li>
<li>Enabled secure keyboard entry in Terminal to prevent other processes from reading keystrokes</li>
<li>Installed rkhunter for rootkit detection, running daily</li>
<li>Installed Lynis for system audit scoring, running daily</li>
<li>Installed mSCP for CIS Level 1 compliance checks, running daily</li>
</ul>
<p>So overall, pretty meh. It was fun though and I think if done well and let to run
perpetually, it could be a neat approach to having an agent actively defend my system.</p>


Kyle Pericak

"It works in my environment"

Categories

Tags