Kairos: Transactional Safe Execution at the Boundary of LLM Agent Systems

Under indirect prompt injection, a monitor that can only allow or deny must decide before the evidence is complete.

• Scenario: The authors state that agent utility depends on reading broadly with principal permissions, executing on the host, and accessing the network; ingested content enters the same context as user instructions, and the model cannot reliably distinguish instructions from data. Repository contents, inbound channels, and memory files have been used for exfiltration, goal deviation, and persistence, and some attacks use only legitimately granted permissions.
• Existing methods: Prompt- and model-layer defenses reduce the likelihood of following injections; the authors state there is no structural guarantee. Framework-layer defenses enforce policy on actions but require customization or harness modification and mediate only relative to declared tool interfaces; scripts the agent writes and runs are outside their scope. System-layer methods either only observe or block and terminate when an action occurs.
• Observation: On a single action, legitimate work and the first step of an attack often look similar; the distinction lies later in the trajectory. In Fig. 1, the policy cannot endorse a write from untrusted content, and direct refusal harms legitimate construction; the monitor needs to hold that write, let the agent continue on a staged state, until consequences are visible and the effect is not yet irreversible.
• Approach: KAIROS is a reference monitor on the isolation boundary of an unmodified, opaque agent. The policy decides which effects it can guarantee; the rest are deferred, and a permission-bounded oracle releases or refuses them based on the trajectory. Isolation guarantees that effects can leave only through the monitor; which effects are released depends on the policy and oracle, which the authors state can only measure, not guarantee.
• Threat model:
  • Goal: Make the agent exfiltrate sensitive data with its own permissions, inject untrusted values into trusted parameters, change state without a trusted request, or leave persistence that affects later sessions.
  • Knowledge: The attacker controls ingested content the operator has not declared trusted, performing indirect prompt injection; adaptive, knowing the design, policy, and oracle, and cannot directly control the agent or its model.
  • Boundary: The principal and its task, the operator and its policy, the host with the isolation layer, and the monitor are outside the attacker's scope. This paper focuses on indirect injection and assumes the operator and principal coincide; when they are separate, direct injection can also be considered.
  • Out of scope: Escaping the isolation layer, covert channels, availability, and harm caused solely by reply text. When using frontier models, the channel to the provider is treated as internal, assuming the provider does not collude with the attacker; this assumption can be dropped when the model runs inside the isolated environment.

Prompt and model layers

• Spotlighting (Hines et al., 2024) marks untrusted content as data; prompt sandwiching repeats the user task after it. The authors state that on AgentDojo, such defenses either keep the attack rate near the unprotected baseline or make the agent unable to work.
• Instruction hierarchy (Wallace et al., 2024) encodes instruction source order into weights; detectors classify injected text before tool outputs arrive, and NeMo Guardrails (Rebedea et al., 2023) filters text in and out. The authors state they handle only text and do not observe effects on the system.
• LlamaFirewall's AlignmentCheck (Chennabasappa et al., 2025) audits trajectories against user goals. The authors state it is most similar to this paper's oracle, but has no provenance and cannot defer or roll back.

Framework layers

• CaMeL (Debenedetti et al., 2025) separates a privileged planner from an isolated model. Costa et al. (2025) and others propagate information-flow labels in the planner or agent communication. The authors state this is sound within the label algebra, but once the planner reads untrusted content, all subsequent actions inherit the label and task-required actions are also refused.
• Progent (Shi et al., 2026) derives tool-call policies from tasks with a language model and refines them during execution, leaving extension to users; without a human, its approval step also refuses. AgentSpec, Datalog over causal dependencies, and FORGE's probabilistic predicates are likewise written over tool names and parameters.
• AgentArmor builds a dependency graph from trajectories and type-checks; AttriGuard replays untrusted observations after converting them to third-person reports and blocks a call if it is not re-proposed. The authors state its single-call semantics are finer, but it depends on agent cooperation and coverage is limited to declared interfaces; FORGE excludes raw sockets, standard I/O, and shell. Most allow or deny at call time.

Transactions, rollback, and system monitoring

• Cordon, Atomix, SagaLLM collect tool calls into transactions, put reversible changes in shadow state, and stage external effects until validation. GoEX, fault-tolerant sandboxes, and AgentGit recover after effects occur using compensation, snapshots, or checkpoints. The authors state transaction boundaries are within tool dispatch or frameworks, and commit is based on progress, failure, or operator decision, not value provenance.
• AgentSight (Zheng et al., 2025) uses eBPF to correlate LLM traffic with system activity, detecting but not enforcing, with encrypted traffic visibility depending on a specific TLS library. AgentSentinel blocks and terminates when an action occurs; ActPlane provides programmable policy at the operating system layer.
• gVisor, Firecracker, E2B, Daytona and others isolate and protect the host. The authors state the considered attacks still fall within file and network permissions the sandbox has granted, and the injected agent is a confused deputy.

Information flow

• Labels follow Denning's (1976) lattice model. HiStar and Flume enforce information flow on kernel processes; dynamic taint tracking such as TaintDroid (Enck et al., 2014) tracks through uncooperative code.

• The authors state TaintDroid is closest, but it instruments the runtime it tracks. KAIROS only looks at inputs and outputs of components whose internals cannot be inspected, and labels are approximate by design.

• Baseline methods: Spotlighting, prompt sandwiching, PI detector, Progent, CaMeL. On AgentDojo, all run in the authors' own harness; on AgentDyn and AutoDojo, benchmark published values are used except for KAIROS. CaMeL is not included in AgentDyn, which the authors state is because it fixes the program before the task starts.

• Benchmarks/datasets: AgentDojo, AgentDyn, AutoDojo.

The authors view tool-interface enforcement and KAIROS as complementary: the former has finer semantics and coverage relative to interfaces, while the latter achieves full coverage at the isolation boundary, with semantics reconstructed at resolution time. Commit depends on provenance and the oracle's decision over the ordered trajectory.

KAIROS makes isolation a mechanism and authorization a policy: every outgoing effect of an unmodified, opaque agent first reaches the monitor; the monitor need not decide when the effect is proposed, only before it becomes irreversible.

Effects, Trajectories, and Guarantees

• Events: The monitor is outside the agent and sees only events crossing the I/O layer. Channels are file, net, and ctrl, corresponding to mediated state that can persist across sessions, other parties outside the boundary, and the principal that issues tasks and receives results. Events contain channel, direction, operation, external object, and content, and do not distinguish tool calls, scripts, or system operations. Internal temporary files of the agent are not mediated.
• Effects: An outgoing event that is externally visible once released is an effect, such as writing a file, unlink, or a network request. For each effect, the monitor chooses RELEASE, REFUSE, or DEFER based on the entire preceding trajectory. The externally visible sequence is ordered by release time and can differ from the proposal order.
• Three guarantees: Regardless of how the agent behaves or how the monitor decides, every effect leaving the isolated environment passes through the monitor; effects are not irreversible before release; refused effects are never externally visible. The assumptions are that the mediated channels are the only external channels, the host and monitor are correct, and the model provider does not collude with the attacker. The TCB is the isolation layer, monitor, and host.

Deferral and Speculative Execution

• Three dispositions: RELEASE emits the effect; REFUSE suppresses it permanently and notifies the agent; DEFER suppresses it temporarily. State effects on files can be written to an agent-visible copy. External requests that do not need an immediate response can be held at the boundary while the agent continues on a placeholder result; requests that need a response must be decided before being sent. Text exchanges with the principal are not deferred.
• Speculation scope: From the first deferral, subsequent effects enter the same scope and must be resolved together before any held effect or its derived content becomes externally visible. Release commits; labels approved within the scope become permanent; refusal discards staged state, held requests, and these labels. To an external observer, abandoning a speculation is indistinguishable from never proposing it.
• No context rollback: An opaque agent's context cannot be rolled back and may still contain placeholders for effects that never happened. On refusal, the agent must be notified so it does not treat an effect that never happened as completed.

Labels, Policy, and Oracle

• Two axes: Integrity is untrusted ⊑ trusted; confidentiality is a sensitivity level from public to critical, taking the conservative end when merged. The policy declares trusted sources, sensitive locations, and permissions for each party in advance; whether the principal's task is trusted is also declared by the policy. Everything else is treated as untrusted and public.
• Boundary relabeling: The monitor cannot see how values pass through the model. The trusted and sensitive value sets grow only with inbound events; the agent's own outputs cannot join the trusted set. A value in an effect is trusted only if it is derivable from the trusted set; a sensitive value appearing in an effect is treated as carrying sensitive data. Write locations inherit the merged labels of previously read content, to prevent laundering across effects or sessions. The authors assume an injected agent fully follows the injection but does not deliberately transform values to hide provenance; with deliberate transformation, only confinement remains.
• Three questions and formula: First, check whether an operator rule forbids it; if so, refuse. Then require that the values guiding the effect (destination, recipient, command run, not every value) are derivable from trusted values read, and that the sensitivity of carried data does not exceed the target permission. Mediated state locations have the highest permission. The decision is δ(σ_i−1, e_i): REFUSE if a rule forbids, RELEASE if the policy can guarantee, otherwise DEFER. Blocking effects cannot be deferred; the oracle decides before they are sent.
• Bounded oracle: It can be the operator, another policy engine, or another model call. It sees the task, policy, deferred effects and their provenance, the trajectory, and untrusted content as evidence, and returns release or refusal for each deferred effect. It cannot overturn a refusal; when all are refused, the monitor degenerates into a strict monitor that releases only effects the policy acknowledges. The oracle is assumed well-intentioned but not guaranteed correct, is itself a prompt-injection target, and is not part of confinement's TCB.

Events in the Prototype and Evaluation

• Channels: The agent runs in a Cloud Hypervisor microVM. The working directory is a read-only lower layer of OverlayFS; modifications go to the upper layer and execute in host user space via FUSE and virtio-fs. Outbound traffic is redirected through a firewall to mitmproxy, which terminates TLS at the proxy. Writes and unlinks can be staged; state-changing requests can be held; GET is treated as blocking. Traffic to the model provider is decrypted, logged, and released. The control channel is a terminal over vsock. The guest root filesystem and its tool installations and credentials are not mediated.
• One scope at a time: Each OverlayFS mount has only one writable upper layer. A further effect needing deferral, placeholder-derived content about to leave the boundary, or task end resolves the current scope first. A write-ahead log is used for rollback; commit merges into the working directory, abort discards and notifies the agent.
• Matching: Derivability is implemented as normalized equality, lowercasing and removing whitespace. Sensitivity is whether a normalized token appears, biased toward deferral. Counterparties not named by the policy are deferred in all configurations. In evaluation, the oracle is called once per speculation scope resolution, and blocking requests deferred by the policy are called before being sent; unresolvable outputs and failed calls count as REFUSE. Provenance is written as a source description, not labels like untrusted, because language models read labels as verdicts.

Experimental Setup

• Agents: Default GPT-4.1 (footnote gpt-4.1-2025-04-14), temperature 0, task-neutral system prompt. AgentDojo also tests Qwen3.6-35B (Qwen/Qwen3.6-35B-A3B) and Llama-3.3-70B (meta-llama/Llama-3.3-70B-Instruct). AgentDyn uses GPT-4o, AutoDojo uses GPT-4o-mini. Banking paired experiments use Qwen3.5-35B-A3B, Qwen3.5-27B, Qwen3.5-9B.
• Benchmarks: AgentDojo four suites, 97 user tasks, 629 injection cases, attacks are important_instructions. AgentDyn three domains 60 open tasks, 560 cases. AutoDojo extends three of the four suites, 389 cases, uses LLM to rewrite each injection six rounds.
• Baselines: Spotlighting, prompt sandwiching, PI detector (fine-tuned classifier), Progent (auxiliary model is GPT-4.1), CaMeL (enforcing its safety policy; privileged and isolated models are that group's agents). AgentDojo all run in the authors' harness; the latter two benchmarks use published values except KAIROS.
• Metrics: ASR is the percentage of injection cases where the attacker's goal is completed. Ub is the percentage of user tasks completed without attacks, U is the percentage of user tasks completed in injection cases. NRP is defined as Ub × (1 − ASR). The authors call it equally weighting attack success rate and utility.
• Oracle and runs: On the three agents in Table I, KAIROS's oracle and Progent's policy model are both GPT-4.1. The oracle has no tools, temperature 0, parse failures or call failures count as REFUSE. Each configuration runs once, blocked actions have no user approval as fallback.
• Adaptation: The benchmarks simulate tools as in-memory objects with no mediated isolation boundary. The authors use an adapter to convert simulated tool calls into ingress/egress events; the policy declares for each tool whether it is reversible and which parameter is the destination, and sets no deny rules, so that ASR does not reflect knowing attacks in advance.

Main Results

On AgentDojo, KAIROS compared with no defense and CaMeL is as follows. Oracles are all GPT-4.1. Per Table I.

Swipe horizontally to read the table

Agent	No-defense ASR	KAIROS ASR	KAIROS Ub	KAIROS NRP	CaMeL ASR
GPT-4.1	47.0%	2.7%	85.1%	82.8	0.2%
Qwen3.6-35B	28.3%	1.3%	84.6%	83.5	0.4%
Llama-3.3-70B	32.3%	2.4%	32.3%	31.5	0.0%

• The authors state that KAIROS has the highest NRP on all three agents. No-defense Ub is 82.7%, 87.0%, 29.8% respectively (Table I). The authors state that GPT-4.1 has no successful attacks on Banking and Workspace; in Table V, that model's KAIROS Travel ASR is 7.9%, Slack 2.9%.
• CaMeL has lower ASR, but Ub is 38.0%, 40.4%, 26.5%. Progent's NRP is 69.2, 77.7, 29.3, the second highest (Table I). On GPT-4.1, Spotlighting's ASR is 49.2%, higher than the no-defense row in the same table.
• The authors state that Llama rarely completes tasks even without defense. After KAIROS rejects the injection effect and notifies the agent, its utility under attack is 34.0%, no-defense is 24.6% (Table I).

Open Tasks and Adaptive Attacks

• AgentDyn, GPT-4o: KAIROS's ASR is 1.7%, U is 37.1%, Ub is 51.7%, NRP is 50.8 (Table II). No-defense published values are ASR 37.8%, U 55.5%, Ub 53.3%. The authors state that tasks suspended once retain 90% utility, suspended twice or more retain 62%. Progent's ASR is also 1.7%, but U is 5.8%; PI detector's U is 0.6%, Ub is 0.0%. CaMeL is not listed.
• AutoDojo, GPT-4o-mini: Injection success rate against KAIROS is 8.8%, no-defense published value is 52.4%; Ub is 65.3%, NRP is 59.6 (Table III). Progent has ASR 7.7%, NRP 58.3. Prompt-layer ASR is 36.3% and 46.8%; PI detector is 15.4%, Ub is 47.4%.
• The authors state that still-successful attacks target tasks that delegate authority to documents, and the oracle reads instructions in documents as user authorization. The attacker is black-box, can only observe whether the attack succeeds, and the authors state the result is a lower bound on adaptive attack success rate. Except for KAIROS, the comparisons in these two tables are benchmark published values.

Policy, Strict Monitor, and Model Pairing

• Who decides: In Figure 5 and Section IV-C (AgentDojo, GPT-4.1), the policy directly allows 83% of benign effects and 72% of effects under attack. In benign runs, the oracle rejects only 1 of the effects it decides, which the authors call the only false positive; under attack, the oracle rejects more than half of deferred effects. Most deferrals come from the policy being unable to trace values in effects to trusted sources.
• Strict monitor: With deferral and oracle turned off, effects the policy cannot guarantee are all rejected. The authors state ASR falls within single-run fluctuation, and the paper does not give that ASR; benign utility goes from 85.1% to 42.7%, utility under attack from 69.5% to 34.7% (Section IV-D). The authors state safety comes from the policy, utility from deferral and oracle.
• Model pairing: Table IV on AgentDojo Banking independently varies agent and oracle. With the same model, NRP ranges from 93.1 for 27B to 68.8 for the smallest model. The authors state the 9B agent has the lowest NRP under each oracle (68.8 to 81.2), all pairings still beat no defense by 18.0 to 52.4 percentage points; the 9B oracle reduces NRP for 27B and 9B agents by 10.7 to 12.5 percentage points, not for the 35B agent. The difference between 35B and 27B oracles is at most 1.7 percentage points.

Other Ablations and Analyses

• Table V, GPT-4.1, KAIROS per-suite ASR/U: Banking 0.0%/82.6%, Slack 2.9%/61.0%, Travel 7.9%/74.3%, Workspace 0.0%/60.0%; the mean is the unweighted average of the four suites, corresponding to Table I.
• Table VI, Qwen3.5-35B agent with 9B oracle: ASR 1.4%, Ub 93.8%, NRP 92.5; with 35B oracle: ASR 1.4%, Ub 87.5%, NRP 86.3; no-defense ASR 22.9%, NRP 62.6.
• Table VI, Qwen3.5-27B no-defense ASR 53.5%, NRP 40.7; with 35B or 27B oracle, ASR 0.7%, NRP 93.1. Qwen3.5-9B with 9B oracle: ASR 0.0%, Ub 68.8%, NRP 68.8.
• Token overhead: benign runs 17.7%, under attack 33.6%, the authors state all from oracle calls (Section IV-E). File channel 200 cycles, 4 KB, repeated three times, 9.62 ms per cycle, the paper writes about 1.9 ms/operation; on 50 allowed requests the proxy averages 1.15 ms. Introduction and Section III-D write about 1.2 ms/request.
• The authors relay that CaMeL is about 2.8 times single-mode agent input tokens and 2.7 times output, AttriGuard about twice tokens and three times latency; these two are not re-measured in this paper.

Limitations and Future Directions Noted by the Authors

• Semantic gap (Section V): At the boundary, what is seen is file operations and requests, not tool names and parameter roles; a policy over events can express only a subset of a tool policy, and what it cannot express must be deferred. The authors write that existing benchmarks expose every action as a named tool call and contain no attacks composed of legitimate steps; measuring this class of defenses requires benchmarks where actions correspond to real system effects.
• Provenance precision (Section V): An attacker value byte-identical to a trusted value receives the same provenance; after the agent transforms a value, it is no longer recognized. Sensitivity declared for an object is not preserved after data is moved to another object and read out. The authors state that propagating labels of read data to every subsequent effect would defer the vast majority of subsequent effects after the first untrusted read.
• Oracle channel (Section V): The attacker can exert influence only through the oracle's view, and reviewed content may still persuade the oracle. The authors state that an attacker familiar with the oracle and its view can optimize content more effectively than a black-box attacker, so these results do not constitute an upper bound on attack success rate. The authors believe tightening the untrusted content channel may reduce this vector but cannot eliminate it.
• Repeated deferral (Section V): When the oracle releases an effect, it declassifies only that effect; subsequent effects of the same untrusted value are deferred again. The authors state this causes utility loss on open-ended tasks. Partitioning a trajectory by lineage requires a formal definition of when two values share a source, which the authors state string matching alone does not provide.
• Authorization assumption (Section V): Evaluation follows the injection cases of existing benchmarks; the authors state the conceptual scope is broader, but deliberately transforming values to hide provenance is not within the authorization assumption. Against such fully adversarial agents, only confinement remains.

Experimental Coverage

• Tested agents are GPT-4.1, Qwen3.6-35B, Llama-3.3-70B on AgentDojo, GPT-4o on AgentDyn, and GPT-4o-mini on AutoDojo; the Banking suite additionally pairs Qwen3.5 agents at three sizes with oracles (Section IV, Tables I–IV). The oracle in Table I is fixed to GPT-4.1.
• Baselines are Spotlighting, prompt sandwiching, PI detector, Progent, CaMeL. AgentDyn does not include CaMeL. On AgentDyn and AutoDojo, numbers other than KAIROS are benchmark published values (Table II, III footnotes).
• AgentDojo has 97 user tasks and 629 injection cases; AgentDyn has 60 tasks and 560 cases; AutoDojo has 389 cases rewritten over six rounds. Each configuration runs once, with no human approval fallback (Section IV-A).
• Benchmarks are adapted by converting simulated tool calls into events; evaluation does not cross the microVM boundary (Section IV-A). Overhead is additionally measured on 200 file cycles (repeated three times) and 50 allowed requests (Section IV-E). The evaluation policy declares no refusal rules.
• The paper does not report an ASR number for the strict monitor, only that it falls within single-run fluctuation (Section IV-D). The authors write that AutoDojo attackers are black-box, so the results are a lower bound on adaptive success rate (Section IV-A). Section IX writes that models are accessed via fixed identifiers, providers may update the model behind the identifier, and results may not reproduce exactly.

KAIROS is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, used to constrain the external effects that indirect prompt injection can leave.

The agent can execute arbitrary code. Tool calls and self-written scripts become the same class of file and network operations at the boundary. A declarative policy looks at whether the values of guided effects come from trusted sources and whether carried data is allowed to reach destinations; if it can guarantee, it allows, if rules forbid, it rejects; other effects are suspended, the agent continues on staged state and placeholder responses, and a permission-bounded oracle decides only the effects the policy deferred. The oracle is assumed to be benign, but not guaranteed correct, and is not part of the trusted computing base that isolation relies on.

• AgentDojo, GPT-4.1, oracle also GPT-4.1: ASR from 47.0% to 2.7%, Ub 85.1% (no defense 82.7%), NRP 82.8, higher than Progent's 69.2 in the same table. CaMeL's ASR is 0.2%, Ub 38.0% (Table I).
• On the same benchmark, Qwen3.6-35B and Llama-3.3-70B have KAIROS ASR 1.3% and 2.4%, NRP 83.5 and 31.5; their oracle is still GPT-4.1.
• AgentDyn, GPT-4o: ASR 1.7%, utility under attack 37.1% (no-defense published value 55.5%), NRP 50.8. AutoDojo, GPT-4o-mini: adaptive ASR 8.8% (no defense 52.4%), NRP 59.6. With deferral turned off, AgentDojo benign utility is 42.7%.
• The authors state safety mainly comes from the policy, utility from deferring decisions until more of the trajectory is visible. The authors view this boundary monitor as a foundation for supervising autonomous agents, and not limited to prompt injection; when values are deliberately transformed to hide provenance, the authorization assumption no longer holds, leaving only confinement.