Where a tool call becomes a file operation

Kairos puts a reference monitor at the isolation boundary of an unmodified, opaque agent. The paper's authors are Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro and Thomas Eisenbarth. A tool call, a shell command, and a script the agent writes all cross that boundary as the same file and network operations. The monitor watches effects, not intentions.

Most effects are decided by a declarative policy that states which sources are trusted. The rest are deferred and held. The agent keeps working while a bounded oracle, a language model or a human, releases or refuses each deferred effect by reading the trace. On AgentDojo, Kairos cut attack success from 47.0% to 2.7%, and benign utility stayed at the level of the undefended agent.

A second paper hides the instruction inside the skill file. The technique is Ciphered Skill Injection, and it encodes an instruction so the agent must decode it before it can follow. The authors tested Caesar and layered variants across eight models and 139 injection-task pairs. In the primary setting with shortened skills, the variants reached attack success rates of up to 47.5% and 40.3%. Decoding does not guarantee success.

Screening those skills is the next problem. SkillScreen is a compact decision model that scores a skill's maliciousness directly from its SKILL.md file in a single forward pass. On MaliciousSkillBench it flagged 20 to 25 percent of benign skills while catching 99 percent of unseen attack families, fewer than the word-level classifier and the prompted judges it was compared against. The authors also found a limit: unfamiliar benign sources sharply increase false positives.

Here the agent is the attacker. ProtoArena is a black-box benchmark of 80 cross-component exploitation environments, spanning 11 protocol and application domains and 7 attack categories. It evaluates five models at three levels of information, from guided reproduction to effect-directed black-box exploration. Claude Opus 4.8 scored highest: 48.8% with guidance, 12.5% under black-box conditions. In a separate DNSBomb experiment it reached a peak byte-rate ratio above 171,000 times. The authors tested only controlled, authorized targets.

The fifth preprint, posted two days earlier, secures the verifier instead of the agent. The verifier is the target. The method sets up an isolated sandbox the agent cannot directly modify, then runs a hacker-fixer loop that finds and repairs remaining weaknesses. Applied to Terminal Bench, KernelBench and SETA, it cut attack success and improved with each loop iteration. An earlier version of the loop has been adopted by the official Terminal Bench repository to audit exploits in its environments.

Log take: The five agree on one thing. Agent security is a property of the boundary, the skills, and the verifier around the model. The bet is to constrain the reach rather than align the mind. (Interpretation; five preprints, none peer-reviewed.)