Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents
Kairos is a reference-monitor-style defense for LLM agents that sits at the system boundary and mediates all effects—tool calls, shell commands, and generated scripts—as file/network operations, using source-trust policies to allow obvious-safe actions and transactionally defer ambiguous ones while the agent keeps running speculatively. The clever bit is that it avoids trying to read the model’s mind and instead waits for enough execution trace to distinguish benign work from indirect prompt-injection attacks, giving strong benchmark results with little utility loss, though it still depends on a bounded decision oracle and policy/source-trust assumptions that may be hard to scale or validate in messier real deployments.
Abstract
Large language model (LLM) agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access. The reach that gives an agent its utility is equally available to an attacker who can steer it. Anything an agent ingests can carry an injected instruction, and since the model does not reliably distinguish instructions from data, indirect prompt injection should be mitigated by mediating the effects the agent produces. Such mediation faces a structural difficulty. Legitimate work and the first step of an attack often look alike when an individual action is observed, and what separates them lies later in the trace, so a monitor limited to allow and deny is forced to decide before the evidence accumulates. We present Kairos, a reference monitor at the isolation boundary of an unmodified, opaque agent, where a tool call, a shell command, and a script the agent writes all cross the boundary as the same file and network operations, so that confinement holds regardless of the agent's behavior. A declarative policy that states which sources are trusted decides most effects deterministically and defers the rest, which are held while the agent continues speculatively. A decision oracle with bounded authority, such as a language model or a human, releases or refuses each deferred effect on the trace. Across three benchmarks and three agent models, Kairos outperforms existing defenses in the trade-off between attack success and utility. In particular, on AgentDojo, it reduces attack success from 47.0\% to 2.7\% while its benign utility stays at the level of the undefended agent.