Names Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agents

Evidence record

October 10 original paper; macOS/Rust kernel cell and object-resolving broker, 74 ground-truth attacks and benign-completion results.

Read the original source ↗

Claim-level citations (3)

• supportsZTAC object-bound broker contains most evaluated attacks but leaves allowed-channel exfiltration: ZTAC puts the agent in a kernel sandbox with only a broker connection; the broker resolves concrete operation objects, authorizes at use, and issues one-time object-bound approvals.

  Abstract; Sections 3-4: threat model, object resolution and broker

• supportsZTAC object-bound broker contains most evaluated attacks but leaves allowed-channel exfiltration: The prototype completed 43 of 46 benign operations but only four of seven complete workflows. Its two successful attacks encoded secrets into requests sent to an allowed destination.

  Abstract; evaluation summary and stated exclusions

• supportsZTAC object-bound broker contains most evaluated attacks but leaves allowed-channel exfiltration: Across 74 ground-truth attack tests, allowlist failed 66, allowlist plus a command sandbox failed 56, while the ZTAC prototype failed 2 and held 14 for review; all ten historical exploit replays were blocked.

  Abstract and Section 1 results