Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

What it is

Kairos is a reference monitor for unmodified, opaque LLM agents, aimed mainly at coding agents. It runs the agent in a microVM and mediates everything that leaves it. A tool call, a shell command and an agent-written script all appear as the same file or network events. This means it needs no cooperation from the agent and does not depend on a declared tool interface.

How it works

The agent runs in a microVM managed by Cloud Hypervisor. Its effects cross three channels: file, net and ctrl (the principal). File writes are staged in an overlay layer exported through FUSE. Network requests go through a TLS-terminating proxy that stalls them until they are resolved.

The operator writes a declarative policy naming trusted sources, sensitive data and the destinations allowed to receive it. For each effect:

flowchart TD
    E[Agent effect] --> P{Policy}
    P -->|trusted source, cleared data| R[Release]
    P -->|rule violation| X[Refuse]
    P -->|cannot vouch| D[Defer and hold]
    D --> S[Agent continues on staged state]
    S --> O{Oracle sees trace}
    O -->|release| R
    O -->|refuse| X

In the paper's example, an injected pre-commit hook write is deferred. The agent commits, the hook runs, and its attempt to exfiltrate a key is refused by policy. On that evidence the oracle discards the hook.

The oracle is an LLM by default. It can be replaced by a human or a policy engine. Its authority is bounded: it decides only what the policy defers. It is outside the TCB because it reads untrusted content and is itself an injection target.

Preconditions / Affected

• Confinement guarantees: every effect passes the monitor, none becomes irreversible before release, and refused effects never become observable.
• These rest on three assumptions:
• The mediated channels are the only exits.
• The model provider does not collude with the attacker. The model channel is treated as internal, and the paper says this is lifted with a locally run model.
• The host and monitor are correct.
• Authorization (blocking the right effects) is not guaranteed. It depends on the policy and on the oracle.
• Provenance assumes the agent follows injections but does not deliberately re-encode values to hide their origin. A value-transforming agent is covered only by confinement.

What to do

The page gives no commands or install steps. The evaluation numbers are the basis for deciding:

• AgentDojo: attack success drops from 47.0% to 2.7%. Benign utility is 85.1% against 82.7% for the undefended agent, as the paper states it.
• Overhead: about 1.9 ms per file operation and 1.2 ms per request.
• Strict mode (refuse everything the policy cannot vouch for): attack success is unchanged within noise, but only 42.7% of benign tasks complete. The deferral and oracle layer is what recovers utility.
• Framework-level defenses either reach slightly lower attack success at under half the utility, or trail Kairos on both.
• Results hold on open-ended tasks, where plan-fixing defenses complete almost no work, and against an adaptive attacker who rewrites injections against Kairos. Evaluation covers three benchmarks and three agent models.

Caveats

• Out of scope: isolation-layer escape, covert channels, availability, and harm done by the agent's response text alone.
• The oracle is trusted to be benign, not correct. Attacks that persuade it are in scope but not ruled out, so security is measured rather than guaranteed.
• Attack success is not zero (2.7% on AgentDojo).
• Only a truncated portion of the paper was available, so the details of the policy language, the oracle's prompt and the benchmark breakdown are not covered here.