Kairos proposes enforcement at a boundary outside the language model's own text. The monitor intercepts consequential shell, tool or script effects and stages selected filesystem or network changes until an external policy decision authorizes commitment. This places the final permission decision in a mechanism separate from the model's narrative…
Inspect the ClaimsCase · DiggingBeagle record
Kairos stages agent side effects pending external authorization
The authors present an enforcement layer outside an agent model or prompt that intercepts file and network effects; some effects are held until a policy decision before being committed. Controlled benchmark results do not establish general production readiness.
Scope
Research prototype, not a generally deployed control
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Remediation
- not applicable
- AI role
- WITH AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is evaluation; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-KAIROS-BOUNDARY-VALVE-01 · CLM-2026-KAIROS-BOUNDARY-VALVE-02 · Kairos: transactional system-boundary enforcement for LLM agents
At a glance
Independent production validation, completeness of system-call mediation, oracle correctness and operational cost require further evidence.
Limits and uncertaintyFull account
Kairos proposes enforcement at a boundary outside the language model's own text. The monitor intercepts consequential shell, tool or script effects and stages selected filesystem or network changes until an external policy decision authorizes commitment. This places the final permission decision in a mechanism separate from the model's narrative justification or requested action.
The preprint reports an AgentDojo attack-success reduction from 47.0 to 2.7 percent while maintaining roughly baseline benign-task utility. Those figures belong to the authors' benchmark, not general production validation. Complete mediation, policy-oracle correctness, latency and bypass resistance remain open engineering questions; interception does not establish safety if the monitor misses a side-effect channel.
Claims & evidence
CLM-2026-KAIROS-BOUNDARY-VALVE-01The Kairos preprint reports reducing AgentDojo attack success from 47.0 percent to 2.7 percent while keeping benign utility around the undefended baseline.supported
Basis: reported finding
- supportsKairos: transactional system-boundary enforcement for LLM agentsprimary disclosure
Paper abstract, benchmark results on AgentDojo
CLM-2026-KAIROS-BOUNDARY-VALVE-02The proposed monitor mediates shell, tool and script actions at a system boundary and holds ambiguous file or network effects for subsequent authorization.supported
Basis: reported finding
- supportsKairos: transactional system-boundary enforcement for LLM agentsprimary disclosure
Paper abstract, reference monitor design
Unknowns and contradictions
- Independent production validation, completeness of system-call mediation, oracle correctness and operational cost require further evidence.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153