The prototype places model-generated code inside a Firecracker microVM with a host broker for network access and secrets. The guest cannot directly select arbitrary Internet destinations; the broker authorizes an external effect and records it. The paper distinguishes the guarantee of controlled exits from the contents of approved HTTPS traffic, which may…
Inspect the ClaimsCase · DiggingBeagle record
Tracekit Box separates agent code execution from host network and secret authority
A proposed microVM agent runtime brokers outbound connections and credentials through host policy, while documenting residual trusted-destination risk.
Policy-attested executionAgent isolation requires bounding indirect outbound authority through allowed services
Scope
Test coverage is author-reported and authorized hosts could relay data; HTTPS content and non-brokered host channels remain limitations.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-TRACEKIT-BOX-BOUNDARIES-A · Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
At a glance
The security boundary belongs in the host broker; a model refusal and an isolation label do not provide the same assurance.
Read the implicationsTest coverage is author-reported and authorized hosts could relay data; HTTPS content and non-brokered host channels remain limitations. No independent real-deployment evaluation of compromised brokers, approved-relay exfiltration or all covert channels is provided.
Limits and uncertaintyFull account
The prototype places model-generated code inside a Firecracker microVM with a host broker for network access and secrets. The guest cannot directly select arbitrary Internet destinations; the broker authorizes an external effect and records it. The paper distinguishes the guarantee of controlled exits from the contents of approved HTTPS traffic, which may remain opaque. This is a research prototype, not independent proof of universal containment or an exploit claim.
The host-side broker, not the guest model, decides what may cross the execution boundary. The Tracekit Box paper describes a Firecracker microVM without a guest network card, host-resolved addresses and host-held credentials substituted into permitted outbound requests. It reports 13 passing KVM end-to-end checks and an offline-verifiable .tkb evidence bundle. Those checks do not prove that every allowed HTTPS destination is trustworthy, that payloads are fully visible, or that the host cannot omit a side effect from the record. The defense is strongest for explicitly brokered paths; evidence completeness remains a separate question.
Mechanism and trust boundary
- 01
Execute untrusted agent code in guest
The microVM provides a separate guest execution domain without a conventional guest NIC.
Boundary: Agent instruction to isolated execution
- 02
Broker outbound capabilities
Host logic mediates destinations and substituted credentials.
Boundary: Guest request to host-authorized effect
- 03
Record authorization and outcome
Signed artifacts describe broker-approved crossings, not every possible malicious action.
Boundary: Authorized exit into independently reviewable record
Claims & evidence
CLM-2026-NOV02-TRACEKIT-BOX-BOUNDARIES-AThe Tracekit Box design runs the agent inside a network-card-free microVM and routes outbound calls through a host-side vsock broker with policy and signed records.supported
Basis: reported finding
- supportsTracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signedprimary disclosure
Threat model, Design: Network and Secrets, Recording the doors, evaluation
CLM-2026-NOV02-TRACEKIT-BOX-BOUNDARIES-BThe Tracekit Box authors report thirteen successful KVM end-to-end checks of brokered agent operations, not a full independent audit of all host egress paths.supported
Basis: reported finding
- supportsTracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signedprimary disclosure
Abstract and Evaluation 7.1, thirteen KVM checks and limitations
Implications
The security boundary belongs in the host broker; a model refusal and an isolation label do not provide the same assurance.
Controls and mitigations
- Enforce destination and credential policy at host boundaries; test approved-relay exfiltration, policy bypass and independent host telemetry.
- Test egress through approved destinations and host-local side effects under synthetic secrets, then reconcile signed bundle entries with independent network and filesystem logs.
Unknowns and contradictions
- Test coverage is author-reported and authorized hosts could relay data; HTTPS content and non-brokered host channels remain limitations.
- No independent real-deployment evaluation of compromised brokers, approved-relay exfiltration or all covert channels is provided.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214