When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems
cs.CR · cs.AI · cs.OS
Quick verdict
SoK mapping LLM-agent security onto OS complete-mediation doctrine; conceptually sharp, well-evidenced, but central irreducibility claim is argued, not proven.
Summary
The paper systematizes the security of LLM agents by treating them as de-facto operating-system kernels: privileged principals that decide which actions execute under standing authority, yet without the reference monitor that classical complete-mediation doctrine requires. Everything hangs on a provenance-versus-semantics axis: a crossing whose mediating rule can be frozen in advance admits a deterministic check (graded 'deployment debt'), whereas a crossing whose judgment requires reading content meaning — data versus instruction, authorized versus unauthorized action — can only be classified probabilistically ('structural gap'). A trust-boundary taxonomy (B0 ingestion and poisoning through B5 cross-tenant serving channels) indexes fifteen attack classes in Table 2, separating deployed exploits — EchoLeak (CVE-2025-32711), AgentFuzz's 34 zero-days (23 CVEs), 341 malicious skills found in the OpenClaw marketplace — from laboratory-only results. Defenses are systematized across runtime monitoring, architectural separation (CaMeL, RobustRAG, MemLineage, FIDES), and authorization tiered by reversibility (rules R1–R3, human gates on irreversible operations; Progent cuts attack success from 39.9% to 1.0% on AgentDojo). The authors argue the mediation gap is irreducible wherever inputs and actions are not pre-enumerated, recast monitor limits as measurable residual miss rates at a declared false-positive budget, and transfer the analysis to a security-first AI-native OS through six criteria, design constraints (Table 5), and a projection principle: structural guarantees narrow an open space at a cost in expressiveness, autonomy, memory, or influence breadth. As a systematization it contributes no new empirical results, and its central impossibility claim remains an informal argument rather than a theorem.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- LLM agents already occupy the kernel's position — privileged principals exercising standing authority — but lack the reference monitor providing complete mediation that classical systems security requires.
- Mediating judgments split along a provenance-vs-semantics axis: provenance judgments admit deterministic checks, while the two semantic judgments (data-vs-instruction, authorized-vs-unauthorized action) leave an irreducible attack residual wherever inputs and actions are not pre-enumerated.
- Attack-success statistics become actionable when graded on a spectrum from deployment debt (a sound deterministic mediator left unused) to structural gap (no such mediator known).
- Current agent-security evaluations systematically overstate deployed security through evaluation-validity failures.
- A security-first AI-native OS must retain enforcement in a deterministic mechanism beneath the model (Table 5), because a fully model-arbitrated core widens the mediation gap to cover availability and tenant isolation.
Strengths
A genuinely discriminating organizing principle
The provenance-vs-semantics axis (§4.1) converts scattered attack reports into a graded scheme with a 'Mediation available' column in Table 2, telling practitioners which gaps a deterministic fix could close today versus which can only be probabilistically bounded.
Evidence-grounded, not armchair
The taxonomy is populated with deployed exploits — EchoLeak (CVE-2025-32711, §5.1), AgentFuzz's 34 zero-days / 23 CVEs (§5.4 B2a), OpenClaw marketplace's 341 of 2,857 malicious skills (§5.4 B2c) — and quantified defenses (Progent 39.9%→1.0% on AgentDojo, §8.1; MCPTox ~66% poisoning success, §5.4).
Doctrinally honest about limits
Constructive design contributions
Forward transfer analysis
Weaknesses
Central claim argued informally
Grading scheme lacks an operational procedure
No new experiments, imported statistics without comparability controls
Forward sections lean on proposals and vendor statements
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a systematization-of-knowledge (SoK) paper on LLM-agent security spanning deployed systems and a prospective 'AI-native OS.' Its central move is reframing agents as de-facto kernels: privileged principals exercising standing authority (§2.1's three properties: standing, broad reach, probabilistic decisions) without the reference monitor that Anderson [29] and Saltzer-Schroeder's complete mediation [18] require. The organizing artifact is the provenance-vs-semantics axis (§4.1): crossings judged over provenance admit rules frozen in advance; crossings judged over content semantics — data-vs-instruction, action-vs-intent — are necessarily classifiers. Three grades follow (deployment debt, mixed, structural gap), and the five contributions (§1, Figure 1) are: a trust-boundary taxonomy (B0 ingestion/poisoning, B1 self-generated deviation, B2 tool interface with B2a/B2b/B2c sub-channels, B3 sandbox escape, B4 inter-agent, B5 serving substrate); a fifteen-class attack index (Table 2); an impossibility analysis of runtime monitoring (§6, largely truncated in extraction); an evaluation-validity systematization (§9, truncated); and a transfer analysis to AI-native OS design (§10, Table 5).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the 'mediation gap' in LLM agent security?
It is this paper's term for the attack residual that remains because two judgments an agent makes — whether content is data or an instruction, and whether an action carries out what the user authorized — cannot be decided by any deterministic rule fixed in advance. They require reading meaning at run time, so the mediator is necessarily a classifier that misses some attacks at any false-positive rate a deployment can tolerate.
What is the difference between 'deployment debt' and a 'structural gap'?
Deployment debt means a sound deterministic mediator (signing, least privilege, sandboxing, channel authentication) already exists but is not deployed, so measured attack success reflects adoption failure. A structural gap means no deterministic mediator is known because the judgment requires semantics, so some residual is unavoidable — though it can be reduced by narrowing the governed space, at a cost in expressiveness, autonomy, memory, or influence breadth (the paper's 'projection principle').
Is prompt injection solvable according to this paper?
Not in general. Injection is a data-versus-instruction semantic judgment, and the authors extend a known impossibility result to argue no detector can block every attack while passing every legitimate flow. Practical mitigation therefore shifts to provenance-based confinement (control/data separation as in CaMeL), provenance-gated memory, and hard human gates on an enumerated set of irreversible operations, with sensitivity taint so reads cannot launder into exfiltration.
What should practitioners deploy today based on this paper?
The grading points to 'deployment debt' fixes with deterministic guarantees: distinct agent identity with per-call least-privilege policies, signed and attested tool configuration, sandboxing, transport integrity (signing on agent tool chains), and human approval gates on a pre-enumerated irreversible set — composed with reversibility rules R1–R3 so locally reversible reads cannot compose into irreversible disclosure.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Text extraction truncated: end of §4.2, most of §6 (runtime monitoring), all of §9 (evaluation validity), and §10.3–10.4 were not visible; judgments about those sections rely on abstract and introduction summaries, hence medium confidence.
- References [1] and [2] (the July 2026 escape disclosures anchoring the motivation) and roughly 80 middle entries were truncated, so those incidents could not be verified.
- Figures 1–5 are assessed only via captions and inline text; visual layout and figure-internal structure were not analyzed.
- Several cited works are 2026 preprints and vendor blog posts that could not be cross-checked offline.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.