AegisExec: a Linux action broker for untrusted AI agents

Description and use

AegisExec is a Linux CLI that mediates untrusted AI agent requests, enforcing workspace boundaries, network isolation, execution limits, and audit logs to prevent credential exposure and uncontrolled execution.

Problem

Untrusted AI agents can cause damage by reading outside their workspace, exposing credentials, or starting unbounded processes; prompt instructions alone do not enforce OS security boundaries.

Outcome

AegisExec successfully blocks traversal attacks, enforces workspace boundaries, isolates network, limits execution resources, and provides audit logs while allowing safe Python execution within a sandbox.

Workflow

• 1. Agent submits a versioned JSON request to AegisExec.
• 2. AegisExec validates the request against a strict schema and trusted policy.
• 3. If denied, AegisExec stops execution and records a metadata-only event.
• 4. If allowed, AegisExec performs the requested operation (read_text, list_dir, or run_python) within a bounded environment.
• 5. For run_python, AegisExec creates a snapshot of admitted workspace files, runs the code in Bubblewrap with network isolation, and enforces execution limits.
• 6. Audit records are generated excluding raw code, file contents, paths, and approval tokens.
• 7. Results are returned as JSON or escaped HTML reports.

Evidence

AegisExec is my experimental defensive project for exploring that boundary: a Linux CLI that evaluates structured action requests before reading workspace files or running Python.

Source

The broker accepts three operations: read_text, list_dir, and run_python.

Source

Five defensive controls: Workspace boundaries, Network isolation, Restricted host actions, Execution limits, Manifest drift review.

Source

The reviewed source passed 69 tests with no skips in Ubuntu 22.04 CI using Python 3.10 and distro Bubblewrap. Those include 17 actual sandbox execution tests.

Source

Audit records exclude raw code, file contents, paths and approval tokens, and hash request identifiers.

Source