Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Key points

• Large language model (LLM) agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access.1
• The reach that gives an agent its utility is equally available to an attacker who can steer it.1
• A decision oracle with bounded authority, such as a language model or a human, releases or refuses each deferred effect on the trace.1
• Across three benchmarks and three agent models, Kairos outperforms existing defenses in the trade-off between attack success and utility.1

Sources (1)

• [1]Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 13, 02:24 PM

  We present Kairos, a reference monitor at the isolation boundary of an unmodified, opaque agent, where a tool call, a shell command, and a script the agent writes all cross the boundary as the same file and network operations, so that confinement holds regardless of the agent's behavior.

  Large language model (LLM) agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access.

Extractive summary: sentences quoted from the sources.