AegisExec: a Linux action broker for untrusted AI agents

Описание и применение

AegisExec – это Linux‑CLI, который проверяет запросы от неtrusted AI‑агентов, ограничивая доступ к файловой системе, изоляцию сети, ресурсы и аудит, предотвращая утечку данных и неконтролируемое выполнение кода.

Задача

Untrusted AI agents can cause damage by reading outside their workspace, exposing credentials, or starting unbounded processes; prompt instructions alone do not enforce OS security boundaries.

Результат

AegisExec successfully blocks traversal attacks, enforces workspace boundaries, isolates network, limits execution resources, and provides audit logs while allowing safe Python execution within a sandbox.

Рабочий процесс

• 1. Agent submits a versioned JSON request to AegisExec.
• 2. AegisExec validates the request against a strict schema and trusted policy.
• 3. If denied, AegisExec stops execution and records a metadata-only event.
• 4. If allowed, AegisExec performs the requested operation (read_text, list_dir, or run_python) within a bounded environment.
• 5. For run_python, AegisExec creates a snapshot of admitted workspace files, runs the code in Bubblewrap with network isolation, and enforces execution limits.
• 6. Audit records are generated excluding raw code, file contents, paths, and approval tokens.
• 7. Results are returned as JSON or escaped HTML reports.

Доказательства

AegisExec is my experimental defensive project for exploring that boundary: a Linux CLI that evaluates structured action requests before reading workspace files or running Python.

Источник

The broker accepts three operations: read_text, list_dir, and run_python.

Источник

Five defensive controls: Workspace boundaries, Network isolation, Restricted host actions, Execution limits, Manifest drift review.

Источник

The reviewed source passed 69 tests with no skips in Ubuntu 22.04 CI using Python 3.10 and distro Bubblewrap. Those include 17 actual sandbox execution tests.

Источник

Audit records exclude raw code, file contents, paths and approval tokens, and hash request identifiers.

Источник