Tracekit Box runs AI agent jobs in networkless Firecracker micro-VMs
Original title: Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
Host doors sign commands, connections, secrets, model calls and patches into one offline-verifiable .tkb bundle.
Tracekit Box v0, released under MIT, runs each AI-agent job in its own Firecracker micro-VM with no network card. Commands, outbound connections, secrets, model calls and workspace patches leave only through host doors over vsock, where a signer the agent cannot reach approves them. Secrets stay outside the VM as placeholders. All 13 end-to-end checks passed, and nine fuzz findings on the trust boundary were fixed. It does not yet run Firecracker's jailer and needs a co-located signer.
Unconfirmed: The authors say all nine fuzz findings were fixed, but the paper does not name the bugs.
- The demo run's 102 signed records verified offline.
- Private and cloud-metadata addresses are always refused.
- The full end-to-end test took 28.5 seconds, including boot.
- Fifteen fuzz targets on the trust boundary produced nine findings.
- In-VM processes are recorded only where they cross a door.
From the original article
1 min read at arxiv.orgAI agents now install packages, call model APIs with their operators' keys and change code in repositories that deploy to production. The network, credentials and write access they need are also how they can leak data, steal a key or change a system nobody approved. Sandboxes contain an agent but leave little evidence of what crossed their boundary; tracing records what happened but contains nothing.
By Bravish Ghosh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.