Paper parks AI-agent pod egress in-kernel until a verifier approves
Original title: Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier Rules
A 98-instruction eBPF hold adds 4.5 ms median per released connection, with 24 microseconds of that in policy.
The paper proposes connection escrow: outbound TCP from a supervised pod is parked in connect() before any packet, then released only on a signed verdict naming that socket cookie and destination. A 36-check adversarial suite reports that forged, replayed, expired, and late verdicts are refused and that child-process and renamed-binary bypasses fail. On Kubernetes, unmodified pods are gated, including a raw socket that bypasses a sidecar, and 600 connections from six pods were held. An eBPF uprobe can score plaintext at the agent TLS library while TLS remains end-to-end.
- Thirty-three of 36 checks also passed on an iptables hold point.
- No verdict by the deadline resets the connection, and a late approval is refused.
- UDP is pinned to the resolver, and the agent’s path to the verifier is itself escrowed.
- Plaintext scoring covers shared OpenSSL, static OpenSSL, and Go crypto/tls.
From the original article
1 min read at arxiv.orgAI agents in containers act by opening network connections, and the text that drives them can be hostile. Controls placed between the agent and its tools are bypassed by a child process or a direct socket, and their approval is not tied to the connection the kernel later opens.
By Ashok Subbabhatta Gopalakrishna · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.