Evidence · DiggingBeagle record
Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
The Tracekit Box design runs the agent inside a network-card-free microVM and routes outbound calls through a host-side vsock broker with policy and signed records.
- Source role
- primary disclosure
Evidence record
The Tracekit Box design runs the agent inside a network-card-free microVM and routes outbound calls through a host-side vsock broker with policy and signed records.
Claim-level citations (2)
- supportsTracekit Box separates agent code execution from host network and secret authority: The Tracekit Box design runs the agent inside a network-card-free microVM and routes outbound calls through a host-side vsock broker with policy and signed records.
Threat model, Design: Network and Secrets, Recording the doors, evaluation
- supportsTracekit Box separates agent code execution from host network and secret authority: The Tracekit Box authors report thirteen successful KVM end-to-end checks of brokered agent operations, not a full independent audit of all host egress paths.
Abstract and Evaluation 7.1, thirteen KVM checks and limitations