Approving the name of a tool or path is not the same as approving the operating-system object that will be used. The paper details symlink and hardlink aliasing, command options, Git configuration discovery, workspace files executed later by external tools, and approval reuse. Its broker authenticates agent requests, resolves targets, enforces policy when…
Inspect the ClaimsCase · DiggingBeagle record
ZTAC object-bound broker contains most evaluated attacks but leaves allowed-channel exfiltration
A preprint demonstrates a macOS agent-confinement system that binds each grant to the actual file, program or endpoint used. In 74 controlled attacks, ordinary allowlists lost 66, sandbox plus allowlist 56, and ZTAC 2.
Scope
Preprint lab measurements with controlled attacks, not a certified commercial sandbox or proof against every exfiltration channel.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The macOS broker prototype was tested against known object-alias and tool-dispatch attacks. Preventing those tests does not establish universal containment of allowed egress paths. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7-ZTAC-DESIGN · CLM-CP7-ZTAC-LIMITS · CLM-CP7-ZTAC-ATTACKS · Names Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agents
At a glance
Open endpoints can still carry sensitive encoded data. The kernel, broker and policy administrator remain trusted; current prototype is macOS-specific. Workflow compatibility beyond seven examples and resistance to previously unseen bypasses are unverified.
Limits and uncertaintyFull account
Approving the name of a tool or path is not the same as approving the operating-system object that will be used. The paper details symlink and hardlink aliasing, command options, Git configuration discovery, workspace files executed later by external tools, and approval reuse. Its broker authenticates agent requests, resolves targets, enforces policy when acting and signs event records. Those protections are evaluated in a limited macOS/Rust prototype; allowed-channel exfiltration and some practical workflows remain unsolved.
Policy keyed to a pathname string is vulnerable to aliasing; the broker instead resolves an object and applies authority when the system call is performed. That choice still relies on correct object-resolution semantics and complete coverage of effects.
Claims & evidence
CLM-CP7-ZTAC-DESIGNZTAC puts the agent in a kernel sandbox with only a broker connection; the broker resolves concrete operation objects, authorizes at use, and issues one-time object-bound approvals.supported
Basis: reported finding
- supportsNames Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agentsprimary disclosure
Abstract; Sections 3-4: threat model, object resolution and broker
CLM-CP7-ZTAC-LIMITSThe prototype completed 43 of 46 benign operations but only four of seven complete workflows. Its two successful attacks encoded secrets into requests sent to an allowed destination.supported
Basis: reported finding
- supportsNames Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agentsprimary disclosure
Abstract; evaluation summary and stated exclusions
CLM-CP7-ZTAC-ATTACKSAcross 74 ground-truth attack tests, allowlist failed 66, allowlist plus a command sandbox failed 56, while the ZTAC prototype failed 2 and held 14 for review; all ten historical exploit replays were blocked.supported
Basis: reported finding
- supportsNames Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agentsprimary disclosure
Abstract and Section 1 results
Unknowns and contradictions
- Open endpoints can still carry sensitive encoded data.
- The kernel, broker and policy administrator remain trusted; current prototype is macOS-specific.
- Workflow compatibility beyond seven examples and resistance to previously unseen bypasses are unverified.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150