Kernel-Level Enforcement for AI Agents via eBPF-LSM and Z3
Solo-built eBPF-LSM prototype enforces AI agent guardrails at the kernel syscall boundary with Z3 SMT checks; open break-it challenge on GitHub.
A solo-built, Apache-2.0 research prototype moves AI agent guardrails out of the process being governed and down to the syscall boundary. The premise: application-layer allowlists share a trust domain with the agent they police, so a prompt-injected agent can simply shell past them. This project instead hooks execve, inode create/unlink, connect, and cap_capable via BPF-LSM, scoping enforcement to the governed agent's cgroup so every other process on the host passes through untouched.
A single userspace daemon per host handles kernel-verified PID/UID checks, HMAC-signed request envelopes, per-agent intent allowlists and quotas, replay/drift detection, and a Z3 SMT check that verifies runtime risk and spending ceilings — with daemon-computed values always overriding client-declared ones. Decisions are appended to a SHA-256 hash-chained audit log.
Measured on real hardware, decision latency sits at microsecond scale (P99 463µs) with roughly 6,500 decisions/sec throughput, and an adversarial suite of over 1,200 hostile requests across ten attack classes produced zero fail-open outcomes. The author documents known limitations — sub-mount path resolution and interpreter-chain escapes — and is explicit that this is an unaudited research prototype, not enterprise-grade, inviting the community to break it.
This synthesis was produced from its source by AI; there is no human editor or manual review step. How we work