Connection Escrow tests signed agent network approval at the kernel socket boundary

Connection Escrow proposes keeping an agent's network request from sending packets until a policy verifier approves the live socket. The prototype binds the decision to specific process/cgroup and destination details with a bounded expiry, then mediates it in the kernel before packets leave. This is narrower than allowing an agent to send arbitrary traffic after a one-time broad approval. The paper reports a series of adversarial tests, concurrent connections and low added hold times in its configured Linux environment.

The mechanism is relevant to a malicious LoRA that leaked by DNS, but the paper does not demonstrate protection against every DNS transport, namespace transition, subprocess race or inherited long-lived socket. It is an experimental egress mediator, not independent proof that all generative agents are contained. The essential control point is below the language model, so a confident textual request cannot independently grant network access.

The proposal's distinctive control is a per-socket hold before traffic is sent. Authorization is tied to socket identity and destination, not just to the tool-call text that requested a connection. The authors evaluated kernel behavior and a separate policy verifier under defined Linux and Kubernetes environments; they did not establish that the verifier's classification of malicious content is always correct. Unsupported kernel versions and untested runtime paths remain separate from measured hold latency.