SentinelLoop
Agentic CIS hardening for Linux servers, with a human in the loop (AgentOps'26 Hackathon, Oct 2026)
A team of AI agents audits Ubuntu servers against the CIS Ubuntu 24.04 Level 1 benchmark, fixes what fails, verifies every fix, and rolls back anything that breaks. A human approves risky changes in a web dashboard and can undo any single setting with one click. Compliance, known vulnerabilities (CVEs) and network exposure are measured separately with OpenSCAP. Everything runs locally: three Ubuntu VMs in VirtualBox, a local LLM in Ollama (qwen2.5-coder:7b), and a Streamlit dashboard.
Source: github.com/Krishna-Gunjan/sysAI
The problem
Hardening a server to the CIS benchmark means working through dozens of controls, and a careless fix can lock you out: a wrong SSH or sudo change on a remote machine is hard to recover from. Letting an LLM make those changes freely is worse. SentinelLoop lets AI do the tedious part while keeping every change bounded, checked, reversible and, where it matters, approved by a person.
The loop
- Audit: OpenSCAP checks against CIS Level 1 (98 controls).
- Plan: choose a vetted fix, or let the LLM propose one.
- Approve: risky changes stop for a human, with the exact dry-run diff.
- Remediate: apply the fix and record its undo steps.
- Verify: the rule must pass and the VM must stay healthy.
- Report: or roll back at once if anything broke.
The agents are an auditor, a planner, a remediator, an approval gate, a verifier and a reporter.
How it stays safe
- No shell for the AI. It can only choose from 15 typed actions, and every field is checked against allowlists. During the hackathon the guardrails blocked 79 unsafe proposals.
- Scope lock. An AI-proposed fix may only touch what the vetted CIS fix for that rule touches.
- Human approval for login, firewall and kernel changes, and for any AI fix that differs from the vetted one.
- Verify or roll back. After each change:
sshd -t, a fresh SSH login, sudo, and the required services and ports. - Undo journal. Every kept change stores its own undo steps; reverting an old change keeps newer ones. Snapshots cover what cannot be undone step by step, such as security patches.
- Isolation. The agents can only reach the allowlisted lab network, and the LLM runs offline.
The lab
Three Ubuntu 24.04 VMs (1 vCPU, 1.5 GB RAM, 12 GB disk each), built deliberately weak so there is something to fix:
| VM | Role |
|---|---|
| lab-web | Web server (nginx on port 80) |
| lab-db | Database role; needs rpcbind |
| lab-legacy | Admin logs in with a password; /etc/login.defs is immutable |
Results
| Measure | Before | After |
|---|---|---|
| CIS compliance, every host | 66.3% | 92% |
| Open ports | 6 | 2 or fewer |
| Known vulnerabilities, web server | 4 | 0 |
| Known vulnerabilities, database server | 4 | 2 |
| Dirty Pipe (CVE-2022-0847) exploit | worked | failed |
Vulnerabilities fall only with the Patch step; hardening alone changes compliance and exposure, not the CVE count.
Limits
- It targets Ubuntu 24.04 and the CIS Level 1 profile (98 controls), tested on a three-VM lab, not on production fleets.
- Live snapshots can hang under Hyper-V, so SentinelLoop always snapshots with the VM shut down.
Stack: Python 3.12, multi-agent LLMs (Ollama, Qwen2.5-Coder), OpenSCAP, Streamlit, VirtualBox.