Small and medium-sized enterprises and independent developers increasingly run production workloads on unmanaged cloud servers yet lack the expertise or budget for continuous hardening. Honeypot studies show internet-facing hosts are attacked within minutes, while CIS benchmarks defining correct hardening contain hundreds of complex, hard-to-automate items. Large language model (LLM) agents introduce a parallel risk: unconstrained tool access lets an agent be manipulated, via prompt injection or reasoning failure, into unauthorized commands — a modern confused-deputy problem. This paper presents Yoru, an AI DevSecOps agent that continuously hardens Ubuntu 24.04 LTS servers against a ten-control CIS-aligned catalog, structurally bounding its reasoning component to a fixed, pre-tested action surface. The architecture separates an LLM layer that prioritizes and explains findings, a static catalog holding all executable commands, and a privilege-bridging dispatcher accepting only a control identifier and one of four fixed actions — bounding a misreasoning or compromised agent to forty pre-vetted, rollback-tested actions rather than arbitrary shell execution. High-risk controls require disclosure-based human approval via a dashboard. We validate the system through exhaustive manual execution of all forty catalog actions, an installer self-test suite, and a network-boundary permission harness, which surfaced four latent defects undetectable through read-only testing, including one control whose apply path was non-functional behind a plausible rejection message. We report these findings, with nine documented limitations, and discuss generalizing the pattern to other domains. The contribution is twofold: an architecture for bounding LLM agent authority, and an empirical case study applying it to unmanaged-server hardening for resource-constrained operators.
References
Ambrozkiewicz, M. (2025). Anatomy of a Linux SSH honeypot attack: Detailed analysis of captured malware. SANS Internet Storm Center Guest Diary. https://isc.sans.edu/diary/32024
Bahtiar, Rabbany, Bele, Husna, & Matulessy (2025). Digital transformation towards sustainability: Challenges and opportunities for Indonesian MSMEs. Jurnal Ekonomi dan Bisnis, 28(1), 131–150.
Collaborative Gym (2024). Collaborative gym: A framework for enabling and evaluating human-agent collaboration. arXiv preprint arXiv:2412.15701.
Deng, Y., & Inthiran, A. (2026). Towards zero trust architecture: A pilot study on information systems security readiness amongst small and medium enterprises. arXiv preprint arXiv:2605.18901.
Deng, Z., Guo, Y., Han, C., Ma, W., Xiong, J., Wen, S., & Xiang, Y. (2024). AI agent security: Emerging threats and defense paradigms. arXiv preprint arXiv:2408.29007.
Ghobakhloo, M., et al. (2022), as cited in MSME Digital Transformation Readiness Study (2023). Micro, small, and medium enterprises' readiness for digital transformation in Indonesia. Journal of Open Innovation: Technology, Market, and Complexity (MDPI), 11(6), 156.
Happer, C. (2025). Human-in-the-loop vs. fully autonomous AI systems for crisis-driven defense electronics manufacturing.
Hardy, N. (1988). The confused deputy: (Or why capabilities might have been invented). ACM SIGOPS Operating Systems Review, 22(4), 36–38.
Honeypot Software Survey (2016). A survey on honeypot software and data analysis. arXiv preprint arXiv:1608.06249.
InfoSecHarry (2025). I deployed a honeypot in the cloud — here's what 10+ hours of attacks revealed. Medium.
Ji, Z., et al. (2026). Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework. arXiv preprint arXiv:2601.11893.
Li, Y., et al. (2024). Personal LLM agents: Insights and survey about the capability, efficiency and security. arXiv preprint arXiv:2401.05459.
Luo, J., Zhang, W., & Yuan, Y., et al. (2025). Large language model agent: A survey on methodology, applications and challenges. arXiv preprint arXiv:2503.21460.