Urim ✠ Thummim

Secure Agentic AI Development Framework

A two-sided security framework inspired by the ancient Urim and Thummim — binary divination stones used for yes/no decisions.

Overview

Based on Johann Rehberger's "Agentic ProbLLMs" research (39c3), this framework addresses critical vulnerabilities in AI coding assistants:

• Prompt Injection leading to RCE and data exfiltration
• ZombAIs — compromised agents joined to C2 infrastructure
• Long-term prompt injection persistence
• Over-reliance on LLM behavior for trust decisions
• Inadequate sandboxing
• Weak user-in-the-loop controls

Components

Component	Hebrew	Meaning	Role
Urim	אוּרִים	"Lights" / "Revelations"	The creative container — where AI agents operate
Thummim	תֻמִּים	"Perfections" / "Truths"	The watchdog — monitors and enforces security

Quick Start

# Clone and setup
cd ~/dev
git clone <repo> urim-thummim
cd urim-thummim

# Set API keys
export ANTHROPIC_API_KEY="your-key"

# Start the framework
./scripts/start.sh

# Check status
./scripts/status.sh

# Connect to Urim container
podman exec -it urim bash

Architecture

┌─────────────────────────────────────────────────────────┐
│                     HOST SYSTEM                          │
│  ┌───────────────────────────────────────────────────┐  │
│  │              THUMMIM (Watchdog)                    │  │
│  │  ┌─────────────────────────────────────────────┐  │  │
│  │  │ Detectors: Process, Network, Filesystem,    │  │  │
│  │  │ Memory, Injection                           │  │  │
│  │  └─────────────────────────────────────────────┘  │  │
│  │  ┌─────────────────────────────────────────────┐  │  │
│  │  │ Enforcers: Log → Throttle → Block →         │  │  │
│  │  │ Freeze → Snapshot → Kill                    │  │  │
│  │  └─────────────────────────────────────────────┘  │  │
│  └───────────────────────────────────────────────────┘  │
│                        │                                 │
│  ┌────────────────────▼────────────────────────────┐    │
│  │              URIM CONTAINER                      │    │
│  │  ┌───────────────────────────────────────────┐  │    │
│  │  │  AI Agent (Claude Code, Aider, etc.)      │  │    │
│  │  └───────────────────────────────────────────┘  │    │
│  │  Isolated • Non-root • Network whitelist       │    │
│  └─────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────┘

Security Features

Detectors (1-second polling)

Detector	Monitors	Response
Process	Blocked binaries, fork bombs	Kill process/container
Network	Unauthorized egress, C2 patterns	Block network
Filesystem	Protected paths, suspicious files	Freeze container
Memory	Resource exhaustion	Throttle
Injection	Prompt injection patterns	Kill agent

Enforcement Actions (Escalation Order)

1. Log — Record anomaly for review
2. Throttle — Reduce container resources
3. Block — Disable network access
4. Freeze — Pause container execution
5. Snapshot — Create forensic snapshot
6. Kill — Terminate container

Development Tools

The Urim container includes pre-installed tools for AI-assisted development:

Core Development

Tool	Purpose
git	Version control
node / npm / npx	JavaScript/TypeScript runtime
python3 / uv	Python runtime and package management
cargo / rustc	Rust development
gcc / make / cmake	C/C++ build tools

PWA Testing with Playwright

Capability	Use Case
E2E Testing	Test login flows, forms, navigation
PWA Validation	Service workers, offline mode, installability
Visual Regression	Screenshot comparison
Accessibility	axe-core integration for a11y testing
API Mocking	Route interception for isolated tests

# Inside Urim container
playwright test e2e/pwa.spec.ts           # Run PWA tests
npx playwright screenshot http://localhost:5173 home.png
npx playwright codegen http://localhost:5173  # Generate tests

Utilities

• rg (ripgrep) - Fast search
• fd - File finder
• bat - Cat with syntax highlighting
• jq / yq - JSON/YAML processing
• nvim - Editor

Documentation

• Architecture — System design details
• Security Model — Trust boundaries and controls
• Threat Model — Based on Rehberger's research
• Deployment — Production deployment guide
• Runbook — Incident response procedures

Requirements

• Fedora 40+ (or compatible Linux)
• Podman 5.0+
• Rust 1.75+ (for building Thummim)
• 16GB+ RAM recommended

Project Structure

urim-thummim/
├── urim/                    # Creative Agent Container
│   ├── Containerfile        # Podman container definition
│   ├── podman-compose.yml   # Container orchestration
│   ├── scripts/             # Container scripts
│   └── config/              # Container configuration
│
├── thummim/                 # Security Watchdog
│   ├── src/                 # Rust source code
│   │   ├── detectors/       # Anomaly detectors
│   │   └── enforcers/       # Enforcement actions
│   └── config/              # Watchdog configuration
│
├── shared/                  # Shared components
│   ├── audit/               # Audit logs (volume mount)
│   └── schemas/             # JSON schemas
│
├── docs/                    # Documentation
└── scripts/                 # Helper scripts

Configuration

Key configuration files:

• urim/config/network-whitelist.json — Allowed domains
• urim/config/allowed-tools.json — Whitelisted binaries
• thummim/config/rules.yaml — Detection rules
• thummim/config/responses.yaml — Response mappings

License

MIT

References

1. Rehberger, J. (2023). "Agentic ProbLLMs: The AI Kill Chain". 39c3.
2. OWASP Top 10 for LLM Applications
3. NIST AI Risk Management Framework