AI Enforcer
Research started and led at NextLabs, showing that AI coding agents and desktop AI apps can read files enterprise security is supposed to protect — and a prototype Windows kernel driver that blocks them.
enforcer — research log
RoleResearch lead
WhenJan – Aug 2026
EventNextLabs
LinksWrite-up on request
01Problem
The read itself is the leak.
AI coding agents and desktop AI apps read files through ordinary OS calls with the user's full permissions. Once read, content goes to the vendor's API, so traditional DLP never sees an upload.
02What I built
Protect the data, not the brand of the tool.
NEXTLABS · JAN–AUG 2026
ATested six AI tools (Claude Code, Codex, Cursor, ChatGPT Desktop, Microsoft 365 Copilot, GitHub Copilot) against file-access controls on Windows.
BA Windows kernel minifilter in C: deny-by-default for protected files except user-launched Office viewers, content-hash detection of renamed or copied files, and blocks on rename, hardlink and memory-mapping — plus a control/audit CLI, PowerShell harness, non-admin agent runner and a disposable-VM kit under Driver Verifier.
CPivoted from identifying AI tools to protecting the data with an allowlist, denying everything else. Found and fixed a double-fault crash in the driver's file-open path.
03Result
14/14 bypass tests blocked. Six-plus hours of adversarial testing with zero crashes. Led a root-cause analysis of 11 system crashes that cleared the driver.
04Stack
CWindows minifilterPowerShellPython
05Threat · Finding · Fix