Kairos: transactional security enforcement at the system boundary for LLM agents

Staging file writes and network requests at a microVM boundary with speculative execution cuts AgentDojo prompt-injection success from 47.0% to 2.7% without degrading benign utility.

Primary source: arXiv:2610.18457: https://arxiv.org/abs/2610.18457

What’s new: Defending LLM agents against indirect prompt injection typically requires modifying the agent harness to intercept declared tool calls, which misses raw shell commands or agent-written scripts, and forces a binary allow-or-deny decision before an action’s downstream consequences are visible. In Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents (arXiv:2610.18457, 13 Oct 2026), researchers from Universitat zu Lubeck, University College London, and MBZUAI introduce Kairos, a system-level reference monitor that mediates unmodified, opaque agents at a Cloud Hypervisor microVM boundary. Every tool invocation, subprocess, or script crosses the boundary as standardized file and network events via a FUSE copy-on-write overlay filesystem and a TLS-terminating proxy, adding approximately 1.9 ms per file operation and 1.2 ms per network request.

Kairos combines deterministic information-flow provenance tracking (over integrity and confidentiality lattices) with transactional deferral. A declarative policy immediately releases effects whose values trace to trusted sources (handling 83% of benign operations without LLM calls) and defers ambiguous effects. Rather than blocking the agent, Kairos stages deferred file writes in the overlay and returns stand-in stubs for stallable network requests while the agent continues in speculative execution. Before a speculative scope becomes externally irreversible, a bounded-authority decision oracle evaluates the accumulated trace against the user’s task to commit or roll back the staged state. On AgentDojo with GPT-4.1, Kairos reduces attack success from 47.0% to 2.7% while preserving full benign utility (85.1% versus 82.7% undefended), whereas a strict non-deferring monitor halves benign utility to 42.7%. Strong gains hold across Qwen3.6-35B (1.3% ASR), Llama-3.3-70B (2.4% ASR), open-ended AgentDyn tasks (1.7% ASR), and adaptive AutoDojo attacks (8.8% ASR versus 52.4% undefended).

Why it matters: Securing autonomous coding and infrastructure agents requires complete mediation that holds even when an agent executes arbitrary shell scripts. Moving enforcement to the microVM I/O boundary and postponing uncertain authorization checks until commit time resolves the classic security-utility trade-off where immediate blocking breaks legitimate multi-step workflows.

Caveats: Because the agent is treated as a black box, provenance is tracked by matching values across the I/O boundary rather than inside model activations, which cannot detect values that a compromised or misaligned model deliberately encodes or transforms. In open-ended AgentDyn workflows, accumulating multiple dependent deferrals reduces task completion under attack (retaining 90% utility past a single held effect, but 62% past two or more). Adaptive attacks can also bypass the oracle (8.8% ASR on AutoDojo) when the user’s prompt delegates authority to an external document containing injected instructions.