Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Summary

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, mediating the file and network operations that its tool calls, shell commands and generated scripts produce. A declarative trust policy decides most effects deterministically and defers the rest, which are held while the agent continues speculatively until a bounded decision oracle, a language model or a human, releases or refuses them. On AgentDojo across three agent models, it reduces attack success from 47.0% to 2.7% while benign utility stays at the undefended agent's level.

Related items

• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• HighCVE-2026-110206: Roo Code command approval bypass in parseCommandLine() via command substitutionSimilar attack · NVD/CVE Database
• HighCVE-2026-110205: Roo Code command approval bypass through parseCommandLine() command substitutionSimilar attack · NVD/CVE Database
• HighCVE-2026-110204: Roo Code command approval bypass through parseCommandLine substitutionsSimilar attack · NVD/CVE Database
• HighCVE-2026-110203: Roo Code command approval bypass via quote-masking regexSimilar attack · NVD/CVE Database