AegisExec: a Linux action broker for untrusted AI agents

说明与用途

AegisExec 是一个 Linux CLI，用于中介不受信任的 AI 代理请求，强制执行工作区边界、网络隔离、执行限制和审计日志，以防止凭据泄露和不受控制的执行。

问题

Untrusted AI agents can cause damage by reading outside their workspace, exposing credentials, or starting unbounded processes; prompt instructions alone do not enforce OS security boundaries.

结果

AegisExec successfully blocks traversal attacks, enforces workspace boundaries, isolates network, limits execution resources, and provides audit logs while allowing safe Python execution within a sandbox.

工作流

• 1. Agent submits a versioned JSON request to AegisExec.
• 2. AegisExec validates the request against a strict schema and trusted policy.
• 3. If denied, AegisExec stops execution and records a metadata-only event.
• 4. If allowed, AegisExec performs the requested operation (read_text, list_dir, or run_python) within a bounded environment.
• 5. For run_python, AegisExec creates a snapshot of admitted workspace files, runs the code in Bubblewrap with network isolation, and enforces execution limits.
• 6. Audit records are generated excluding raw code, file contents, paths, and approval tokens.
• 7. Results are returned as JSON or escaped HTML reports.

证据

AegisExec is my experimental defensive project for exploring that boundary: a Linux CLI that evaluates structured action requests before reading workspace files or running Python.

来源

The broker accepts three operations: read_text, list_dir, and run_python.

来源

Five defensive controls: Workspace boundaries, Network isolation, Restricted host actions, Execution limits, Manifest drift review.

来源

The reviewed source passed 69 tests with no skips in Ubuntu 22.04 CI using Python 3.10 and distro Bubblewrap. Those include 17 actual sandbox execution tests.

来源

Audit records exclude raw code, file contents, paths and approval tokens, and hash request identifiers.

来源