Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Kristoffer Hempel; Nils Loose; Lorenzo Cavallaro; Thomas Eisenbarth

cs.CROct 13, 2026

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Authors: Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro, Thomas Eisenbarth

Organizations: Universität zu Lübeck · University College London · Mohamed bin Zayed University of Artificial Intelligence

Abstract

Large language model (LLM) agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access. The reach that gives an agent its utility is equally available to an attacker who can steer it. Anything an agent ingests can carry an injected instruction, and since the model does not reliably distinguish instructions from data, indirect prompt injection should be mitigated by mediating the effects the agent produces. Such mediation faces a structural difficulty. Legitimate work and the first step of an attack often look alike when an individual action is observed, and what separates them lies later in the trace, so a monitor limited to allow and deny is forced to decide before the evidence accumulates. We present Kairos, a reference monitor at the isolation boundary of an unmodified, opaque agent, where a tool call, a shell command, and a script the agent writes all cross the boundary as the same file and network operations, so that confinement holds regardless of the agent's behavior. A declarative policy that states which sources are trusted decides most effects deterministically and defers the rest, which are held while the agent continues speculatively. A decision oracle with bounded authority, such as a language model or a human, releases or refuses each deferred effect on the trace. Across three benchmarks and three agent models, Kairos outperforms existing defenses in the trade-off between attack success and utility. In particular, on AgentDojo, it reduces attack success from 47.0% to 2.7% while its benign utility stays at the level of the undefended agent.

Figures & tables

Fig. 1: Deferral in Kairos . Eve’s guide injects a hook the policy cannot vouch for, so the write is deferred. The agent continues, its commit runs the hook, and the hook’s attempt to exfiltrate Alice’s key is refused by the policy. On this evidence, the oracle discards the hook.

Fig. 2: Threat model overview.

Fig. 3: Speculative execution example. Badges mark the policy’s decision per effect (a check for release, a question mark for defer). From the first deferral on, effects are held in a speculative scope until the oracle resolves it.

Fig. 4: Overview of Kairos .

		GPT-4.1				Qwen3.6-35B				Llama-3.3-70B
Level	Defense	ASR $\downarrow$	U $\uparrow$	U b $\uparrow$	NRP $\uparrow$	ASR $\downarrow$	U $\uparrow$	U b $\uparrow$	NRP $\uparrow$	ASR $\downarrow$	U $\uparrow$	U b $\uparrow$	NRP $\uparrow$
–	No defense	47.0	59.8	82.7	43.8	28.3	72.0	87.0	62.4	32.3	24.6	29.8	20.2
Model	PI detector [ 36 ]	9.5	24.0	40.1	36.3	2.9	29.8	50.5	49.0	4.0	17.0	20.1	19.3
Prompt	Prompt sandwiching [ 36 ]	44.6	63.7	87.6	48.5	14.4	77.1	86.3	73.9	22.5	26.9	30.8	23.9
	Spotlighting [ 12 ]	49.2	54.2	81.7	41.5	30.8	69.7	83.8	58.0	28.7	23.9	38.0	27.1
Framework	Progent [ 16 ]	11.5	57.6	78.2	69.2	5.4	70.2	82.1	77.7	8.0	32.0	31.8	29.3

TABLE I: Comparison of defenses on AgentDojo with three agent models (%).

Level	Defense	ASR $\downarrow$	U $\uparrow$	U b $\uparrow$	NRP $\uparrow$
–	No defense †	37.8	55.5	53.3	33.2
Model	PI detector †	0.9	0.6	0.0	0.0
Prompt	Prompt sandwiching †	31.2	56.1	63.3	43.6
	Spotlighting [ 12 ] †	27.6	52.2	55.0	39.8
Framework	Progent [ 16 ] †	1.7	5.8	6.7	6.6
System	Kairos	1.7	37.1	51.7	50.8

TABLE II: Comparison of defenses on AgentDyn with GPT-4o as the agent (%).

Level	Defense	ASR $\downarrow$	U b $\uparrow$	NRP $\uparrow$
–	No defense †	52.4	66.7	31.7
Model	PI detector †	15.4	47.4	40.1
Prompt	Prompt sandwiching †	36.3	59.6	38.0
	Spotlighting [ 12 ] †	46.8	59.6	31.7
Framework	Progent [ 16 ] †	7.7	63.2	58.3
System	Kairos	8.8	65.3	59.6

TABLE III: Comparison of defenses on AutoDojo with GPT-4o-mini as the agent (%).

Fig. 5: Decisions per effect on AgentDojo (GPT-4.1, %).

		Oracle
Agent	None	35B	27B	9B
Qwen3.5-35B	62.6	86.3	87.5	92.5
Qwen3.5-27B	40.7	93.1	93.1	80.6
Qwen3.5-9B	50.8	79.5	81.2	68.8

TABLE IV: NRP with agent and oracle models varied independently (%, AgentDojo Banking).

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

		Banking		Slack		Travel		Workspace		Mean
Level	Defense	ASR	U	ASR	U	ASR	U	ASR	U	ASR	U	U b	NRP
GPT-4.1
–	No defense	43.1	83.3	88.6	60.0	21.4	67.9	35.0	27.9	47.0	59.8	82.7	43.8
Model	PI detector	3.5	30.6	16.2	30.5	0.0	13.6	18.3	21.2	9.5	24.0	40.1	36.3
Prompt	Prompt sandwiching	36.8	86.1	74.3	62.9	37.1	62.1	30.0	43.8	44.6	63.7	87.6	48.5
	Spotlighting	45.1	79.2	81.9	54.3	28.6	58.6	41.2	24.6	49.2	54.2	81.7	41.5

Appendix

TABLE V: AgentDojo per suite for the three agents (%). Columns as in Table I ; means are unweighted over the four suites.

Agent	Oracle	ASR $\downarrow$	U $\uparrow$	U b $\uparrow$	NRP $\uparrow$
Qwen3.5-35B	None	22.9	78.5	81.2	62.6
	Qwen3.5-35B	1.4	77.1	87.5	86.3
	Qwen3.5-27B	0.0	80.6	87.5	87.5
	Qwen3.5-9B	1.4	79.2	93.8	92.5
Qwen3.5-27B	None	53.5	75.7	87.5	40.7
	Qwen3.5-35B	0.7	85.4	93.8	93.1

Appendix

TABLE VI: Agent and oracle models varied independently (%, AgentDojo Banking).

Explore similar work

Agent-Sentry: Bounding LLM Agents via Execution Provenance
Mar 24, 2026Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1AI Agent Security AI Agent Monitoring
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany
The LLMbda Calculus: AI Agents, Conversations, and Information Flow
Feb 23, 2026Zac Garby, Andrew D. Gordon, David SandsPrompt Injection Attacks on AI Agents LLM Agent Harnesses
University of Nottingham, Nottingham, UK · University of Edinburgh, Edinburgh, UK · Chalmers University of Technology and University of Gothenburg, Gothenburg, Sweden

Mar 24, 2026J/K move · Enter open · S save

Agent-Sentry: Bounding LLM Agents via Execution Provenance

Rohan Sequeira, Stavros Damianakis, Umar Iqbal, Konstantinos Psounis

University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA

AI Agent Security AI Agent Monitoring Runtime Enforcement for AI Agents Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

Agentic computing systems, while immensely capable, raise serious security, privacy, and safety concerns. A key issue is that the full set of functionalities offered by these systems, combined with their probabilistic execution flows, is not known beforehand. Given this lack of characterization, it is challenging to validate whether a system has successfully carried out the user's intended task or instead executed irrelevant actions, potentially as a consequence of compromise. We present Agent Sentry, a runtime defense that learns a bound on an agent's benign execution from prior legitimate executions and flags any action that falls outside this bound. Agent Sentry layers three complementary checks: a structural classifier over the sequence of actions and the provenance of each function's arguments; a deterministic allowlist check over sensitive argument values; and an LLM judge, invoked only on the residual of actions where the first two checks cannot safely decide between a legitimate new request and a carefully crafted injection. We demonstrate the effectiveness of Agent Sentry in AgentDojo and AgentDyn by blocking 94.3% of successful injections while allowing 95.1% of benign executions, without modifying the agent, its tools, or the LLM.

Abstract

Explore similar work

Agent-Sentry: Bounding LLM Agents via Execution Provenance

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

The LLMbda Calculus: AI Agents, Conversations, and Information Flow