AG-023: Self-Modification: File Write Access to Own Source

What this rule means

The agent can write to its own code, prompts or configuration. Any injected instruction can then be made persistent, surviving the restart that would otherwise have cleared it.

Why it matters

Self-modification converts a one-shot injection into a durable backdoor, and it defeats incident response that assumes restarting the agent restores a known state.

How to fix it

Mount the agent's own source, prompts and config read-only; require an out-of-band change process for anything that survives a restart.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-023          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules