Pith. sign in

REVIEW 2 major objections 1 minor 2 cited by

ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses

T0 review · 2 major / 1 minor · reviewed 2026-07-02 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ActPlane enforces AI agent policies at the OS kernel with an IFC DSL to cover indirect execution paths missed by tool interception.

desk verdict ActPlane puts agent policy enforcement into the kernel with eBPF and a simple IFC DSL to catch indirect paths, but the abstract gives almost no experimental details so the compliance and overhead numbers are hard to assess. read the letter →

arxiv 2606.25189 v2 pith:24S7H46Q submitted 2026-06-23 cs.OS

Yusheng Zheng , Tianyuan Wu , Quanzhi Fu , Tong Yu , Wenan Mao , Tao Ma , Dan Williams , Wei Wang
show 1 more author
Andi Quinn
This is my paper
classification cs.OS
keywords AIagentspolicyenforcementOSkerneleBPFinformationflowcontrolagentharnessessafetypoliciessystemactions
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces ActPlane to address the gap between natural-language policy intent in AI agent harnesses and concrete enforcement on system actions. It claims that existing tool-call guardrails miss actions bypassing the tool layer while OS sandboxes give opaque errors instead of useful feedback. ActPlane lets agents declare policies in a simple information-flow control DSL and enforces them inside the kernel using eBPF, providing isolation and semantic responses. A sympathetic reader would care because production agents need reliable compliance on ordering and data-flow rules without high cost or missed violations. Evaluation on empirical policies, coding benchmarks, and safety benchmarks shows improved compliance at 1.9 to 8.4 percent overhead.

What carries the argument

ActPlane policy engine implemented with eBPF that uses an information-flow control DSL to express and enforce cross-event policies at the OS level.

What would settle it

A policy drawn from the empirical study that cannot be expressed in the IFC DSL or an indirect execution path on which ActPlane still permits a violation.

Watch

Extended reading notes

Core claim

ActPlane is a policy engine that lets agents declare policies in a simple information-flow control DSL and enforces them in the OS kernel with semantic feedback and isolation, improving policy compliance including on indirect execution paths that tool-call interception cannot observe at 1.9 to 8.4 percent overhead.

Load-bearing premise

The simple information-flow control DSL is expressive enough to capture the cross-event policies and data-flow constraints arising in real agent harnesses without requiring substantial manual translation or loss of intent.

Editorial extensions

If this is right

  • Enforcement applies to system actions that bypass the tool layer entirely.
  • Agents receive semantic feedback rather than opaque sandbox errors.
  • Policies involving event ordering and data flows become enforceable at the kernel.
  • Overhead stays low enough for production harnesses on the evaluated benchmarks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Kernel-level programmable enforcement could reduce dependence on user-space guardrails for autonomous agents.
  • The same DSL approach might extend to domains like robotic control where high-level rules must constrain low-level actions.
  • Automating translation from natural-language policies into the IFC DSL would be a natural next step to test.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 1 minor

Summary. The paper introduces ActPlane, an OS-level policy engine for AI agent harnesses. Policies are declared by agents in a simple information-flow control (IFC) DSL that supports cross-event ordering and data-flow constraints; enforcement occurs in the kernel via eBPF, providing semantic feedback and isolation. The central claim is that this approach improves policy compliance (including on indirect execution paths missed by tool-call interception) relative to existing guardrails and sandboxes, with measured overhead of 1.9%-8.4%. Evaluation is performed on policies drawn from an empirical study, coding-task benchmarks, and safety benchmarks.

Significance. If the compliance gains and overhead figures are reproducible and the IFC DSL proves expressive enough for natural-language policies without substantial loss of intent, the work would offer a practical bridge between high-level agent policies and low-level system actions. The eBPF-based kernel enforcement with semantic feedback, rather than opaque errors, is a concrete technical contribution that could influence secure agent deployment.

major comments (2)
  1. [Abstract] Abstract: the abstract asserts specific compliance improvements and 1.9%-8.4% overhead on indirect paths but supplies no experimental methodology, baseline comparisons, dataset details, or error analysis. This information is load-bearing for the central empirical claim and must be supplied before the numbers can be assessed.
  2. [Abstract] Abstract / §Evaluation: the claim that the simple IFC DSL supports the cross-event policies 'from the empirical study' is not accompanied by any report of translation effort, completeness, or cases in which policy intent could not be expressed without approximation. If substantial manual rewriting or loss of intent occurs, the measured compliance gains would not generalize to the natural-language policies the system targets.
minor comments (1)
  1. The GitHub repository is referenced but the manuscript does not indicate whether the evaluation scripts, policy translations, or benchmark harnesses are included and runnable.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on the abstract and the evaluation claims regarding the IFC DSL. We address the two major comments point by point below, indicating planned revisions where appropriate.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the abstract asserts specific compliance improvements and 1.9%-8.4% overhead on indirect paths but supplies no experimental methodology, baseline comparisons, dataset details, or error analysis. This information is load-bearing for the central empirical claim and must be supplied before the numbers can be assessed.

    Authors: We agree that the abstract, being a concise summary, does not detail the experimental methodology, baselines, datasets, or error analysis. These elements are fully described in the Evaluation section, which covers the policies drawn from the empirical study, coding-task and safety benchmarks, comparisons against tool-call guardrails and OS sandboxes, and overhead measurements (including the reported range). To improve self-containment of the abstract while respecting length constraints, we will add a brief clause summarizing the evaluation setup and baselines. revision: partial

  2. Referee: [Abstract] Abstract / §Evaluation: the claim that the simple IFC DSL supports the cross-event policies 'from the empirical study' is not accompanied by any report of translation effort, completeness, or cases in which policy intent could not be expressed without approximation. If substantial manual rewriting or loss of intent occurs, the measured compliance gains would not generalize to the natural-language policies the system targets.

    Authors: The manuscript evaluates ActPlane on policies drawn from the empirical study but does not include a dedicated report on translation effort, completeness, or any cases of approximation or intent loss. This is a valid observation that affects assessment of generalizability to natural-language policies. We will revise the Evaluation section to add this analysis, including details on how policies were mapped to the IFC DSL, the effort required, and any limitations encountered. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: implementation and empirical evaluation with no derivations or fitted predictions

full rationale

The paper describes a systems implementation (ActPlane with eBPF and IFC DSL) plus measurements on compliance and overhead. No equations, predictions, or parameter fits are present that could reduce to inputs by construction. Claims rest on direct evaluation against benchmarks and policies rather than self-referential logic or self-citation chains. This matches the default case of a non-circular engineering paper.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Abstract-only review yields insufficient detail to enumerate concrete free parameters or invented entities; the central claim rests on the unexamined assumption that the IFC DSL can faithfully represent required policies.

assumptions (1)
  • domain assumption Natural-language policies can be adequately expressed in the simple IFC DSL without loss of intent or need for extensive manual engineering
    Invoked to bridge the semantic gap between policy intent and kernel actions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses." pith.science (2026). https://pith.science/paper/24S7H46Q

@misc{pith2026260625189,
  author       = {Pith},
  title        = {Pith review of: ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/24S7H46Q}},
  note         = {Machine review of arXiv:2606.25189}
}
read the original abstract

AI agents increasingly run in production through harnesses, the software around the LLM, including an engine that enforces safety and effectiveness policies, e.g., 'run tests before committing.' Enforcing these policies requires bridging a semantic gap: policy intent is expressed in underspecified natural language, while enforcement must act on concrete system actions, e.g., which test to run. Many policies also define event ordering or data flow actions. Yet existing approaches fall short. Tool-call guardrails miss system actions that bypass the tool layer, while OS sandboxes control resource access instead of actions, returning opaque errors that confuse the agent. Our key insight is that policy context lives within the agent closest to the task, while enforcement must happen at the OS to cover all execution paths. We introduce ActPlane, a policy engine that lets agents declare policies and enforces them in the OS kernel with semantic feedback and isolation. ActPlane uses a simple information-flow control (IFC) DSL to support cross-event policies. We implement ActPlane with eBPF and evaluate it on policies from the empirical study, coding-task benchmarks, and safety benchmarks. ActPlane improves policy compliance, including on indirect execution paths that tool-call interception cannot observe, with 1.9%-8.4% overhead. ActPlane is at https://github.com/eunomia-bpf/ActPlane

Figures

Figures reproduced from arXiv: 2606.25189 by the authors.

Figure 1
Figure 1. ActPlane enables the agent closest to the task to write concrete policy DSLs according to its intent or the higher authorities’ instructions. The DSL is then compiled by ActPlane and enforced inside the OS kernel. A major component of the harness is a policy engine, which observes and enforces instructions and constraints (e.g., run tests before commit) over the agent’s concrete ac￾tions. Projects encode many such p… view at source ↗
Figure 2
Figure 2. Policy fraction per repository by statement count. Most repositories contain a majority of policy statements. UTC, contains 64 repositories with median 20K GitHub stars, 84 instruction files, and 2,116 extracted statements. We extract and validate statements from raw instruction files in three steps. (1) A two-pass LLM Agent-assisted pipeline extracted statements with source line ranges and four labels: content type… view at source ↗
Figure 6
Figure 6. Context-requirement waterfall. Each system-level policy exits at the first matching tier. “the migration tool”; or task context, if it depends on the cur￾rent request or a per-session grant such as “unless explicitly requested” or “without approval”. Most policies are not self-contained. Of the 1,127 system￾observable policies, only 26.4% are self-contained; 64.2% re￾quire project context, where concepts such as “th… view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Enforcement profile by topic, normalized. Topics exhibit distinct archetypes, and cross-event policies concen￾trate in Development Process. triggers couple operations (“if you change specs, also update the SDK”). None can be decided from a single event: enforce￾ment mu…
Figure 7
Figure 7. Figure 7: Context requirement by enforcement level. Cross￾event policies are 95% context-dependent, while content poli￾cies are 42% self-contained. OS, prompt instructions rely on the model’s own compliance capabilities [26, 29, 41] but are vulnerable to prompt injec￾tion [15, 2…
Figure 9
Figure 9. Figure 9: Three ActPlane DSL rule examples drawn from real projects: a per-event block (no-delete-data), a cross-event kill gate (tests-before-commit), and a cross-event notify gate (regen-after-schema). kill write suits a compromised agent writing outside its sandbox that shoul…
Figure 10
Figure 10. Figure 10: RQ2 evaluation pipeline: four enforcement paths from natural-language policy to agent-level decision. The dataset exercises most DSL features, validating the language’s expressiveness. Effects skew toward observa￾tion, with 66% of clauses being notify, 29% block, and …
Figure 11
Figure 11. Figure 11: Overall RQ2 Decision Compliance Rate across 190 traces under two end-to-end model settings. In each setting, the tested agent, prompt-filter classifier, and trajectory judge use the indicated model [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]
Figure 12
Figure 12. Figure 12: RQ2 breakdown by trace family. Cells show DCR in percent for each system×family; darker is higher. 86 of 114 at 75%, compared with 27–44 for baselines or 2.0– 3.2× improvement. This advantage stems from detection rate, with ActPlane detecting 77.2% of violations while…
Figure 13
Figure 13. Figure 13: End-to-end overhead normalized to native exe￾cution [PITH_FULL_IMAGE:figures/full_fig_p010_13.png]
Figure 14
Figure 14. Figure 14: OctoBench 21-task subset with 61 DSL rules: reward breakdown by system. Results. ActPlane improves user-query and imple￾mentation/test reward metrics over baseline. The im￾provement concentrates on task-specific checks, with user￾query reward rising by 9.9 points and …
Figure 15
Figure 15. Figure 15: RQ5: Outcome distribution on all 361 OpenA￾gentSafety tasks. ActPlane reduces baseline-unsafe outcomes from 106 to 28 at 74% prevention rate using policies gener￾ated from task descriptions without human tuning. ActPlane policy compiled to an eBPF configuration blob. …

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs

    cs.CR 2026-07 conditional novelty 6.0 of 10

    FAVA enforces agent permissions by lowering LLM-parsed tasks into evidence-backed graphs checked by an SMT solver, matching benchmark ground truth on 90.5% of 801 decisions.

  2. KernelScript: Cross-Boundary Typed DSL for eBPF Applications

    cs.PL 2026-07 conditional novelty 6.0 of 10

    A unified-source DSL for eBPF that types maps, program handles, and execution domains, turning cross-boundary bugs into compile-time errors while emitting standard C for the existing toolchain.

Reference graph

Works this paper leans on

63 extracted references · 63 canonical work pages · cited by 2 Pith papers

  1. [1]

    Anthropic. 2025. Claude Code.https://code.claude.com/docs

    work page 2025

  2. [2]

    Anthropic. 2026. Claude Code Hooks.https://code.claude.com/docs/ en/hooks

    work page 2026

  3. [3]

    Aqua Security. 2026. Tracee: Linux Runtime Security and Forensics using eBPF.https://github.com/aquasecurity/tracee

    work page 2026

  4. [4]

    Adam Bates, Dave Tian, Kevin R. B. Butler, and Thomas Moyer. 2015. Trustworthy Whole-System Provenance for the Linux Kernel. In24th 12 USENIX Security Symposium (USENIX Security 15). USENIX Associa- tion, Washington, DC, 319–334.https://www.usenix.org/conference/ usenixsecurity15/technical-sessions/presentation/bates

    work page 2015

  5. [5]

    Birgitta Böckeler. 2026. Harness Engineering for Coding Agent Users. https://martinfowler.com/articles/harness-engineering.html. Pub- lished April 2, 2026

    work page 2026

  6. [6]

    Canonical Ltd. 2024. AppArmor Security Profiles.https://apparmor. net/

    work page 2024

  7. [7]

    Hassan, and Hajimu Iida

    Worawalan Chatlatanagulchai, Hao Li, Yutaro Kashiwa, Brittany Reid, Kundjanasith Thonglek, Pattara Leelaprute, Arnon Rungsawang, Bun- dit Manaskasemsak, Bram Adams, Ahmed E. Hassan, and Hajimu Iida. 2025. Agent READMEs: An Empirical Study of Context Files for Agentic Coding. arXiv:2511.12884.https://arxiv.org/abs/2511.12884

    work page arXiv 2025

  8. [8]

    Worawalan Chatlatanagulchai, Kundjanasith Thonglek, Brittany Reid, Yutaro Kashiwa, Pattara Leelaprute, Arnon Rungsawang, Bundit Man- askasemsak, and Hajimu Iida. 2026. On the Use of Agentic Coding Manifests: An Empirical Study of Claude Code. InProduct-Focused Software Process Improvement. Springer Nature Switzerland, 543–551. doi:10.1007/978-3-032-12089-2_40

    work page doi:10.1007/978-3-032-12089-2_40 2026

Show all 63 references
  1. [9]

    Zhaorun Chen, Mintong Kang, and Bo Li. 2025. ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning. InProceedings of the 42nd International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 267). PMLR, 8313–8344.https://proceedings. ...

    2025

  2. [10]

    Sahana Chennabasappa, Cyrus Nikolaidis, Daniel Song, David Molnar, Stephanie Ding, Shengye Wan, Spencer Whitman, Lauren Deason, Nicholas Doucette, Abraham Montilla, Alekhya Gampa, Beto de Paola, Dominik Gabi, James Crnkovich, Jean-Christophe Testud, Kat He, Rashnil Chaturvedi,...

    2025

  3. [11]

    Cilium Project. 2026. Tetragon: eBPF-based Security Observability and Runtime Enforcement.https://tetragon.io/

    2026

  4. [12]

    James Clause, Wanchun Li, and Alessandro Orso. 2007. Dytan: A Generic Dynamic Taint Analysis Framework. InProceedings of the 2007 International Symposium on Software Testing and Analysis. Association for Computing Machinery, London, United Kingdom, 196–206. doi:10. 1145/127346...

    2007

  5. [13]

    Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santi- ago Zanella-Béguelin. 2025. Securing AI Agents with Information-Flow Control. arXiv:2505.23643.https://arxiv.org/abs/2505.23643

    2025 arXiv

  6. [14]

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, An- dreas Terzis, and Florian Tramèr. 2025. Defeating Prompt Injections by Design. arXiv:2503.18813.https://arxiv.org/abs/2503.18813

    2025 arXiv

  7. [15]

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer- Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dy- namic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. InAdvances in Neural Information Processing Systems, Vol. 37. Cu...

    2024 doi

  8. [16]

    DeepSeek-AI. 2026. DeepSeek-V4: Towards Highly Efficient Million- Token Context Intelligence. Technical report.https://huggingface.co/ deepseek-ai/DeepSeek-V4-Pro/resolve/main/DeepSeek_V4.pdf

    2026

  9. [17]

    Deming Ding, Shichun Liu, Enhui Yang, Jiahang Lin, Ziying Chen, Shihan Dou, Honglin Guo, Weiyu Cheng, Pengyu Zhao, Chengjun Xiao, Qunhong Zeng, Qi Zhang, Xuanjing Huang, Qidi Xu, and Tao Gui. 2026. OctoBench: Benchmarking Scaffold-Aware Instruction Following in Repository-Grou...

    2026

  10. [18]

    Jake Edge. 2015. A seccomp overview.https://lwn.net/Articles/ 656307/

    2015

  11. [19]

    Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N

    William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. 2010. TaintDroid: An Information-Flow Tracking System for Re- altime Privacy Monitoring on Smartphones. In9th USENIX Symposium on Operating Systems Design and Implem...

    2010

  12. [20]

    Matthias Galster, Seyedmoein Mohsenimofidi, Jai Lal Lulla, Muham- mad Auwal Abubakar, Christoph Treude, and Sebastian Baltes. 2026. Configuring Agentic AI Coding Tools: An Exploratory Study. In ACM AIware 2026. Association for Computing Machinery.https: //openreview.net/forum?...

    2026

  13. [21]

    Sangam Ghimire, Nirjal Bhurtel, Roshan Sahani, and Sudan Jha. 2025. eBPF-PATROL: Protective Agent for Threat Recognition and Over- reach Limitation using eBPF in Containerized and Virtualized En- vironments. InProceedings of the National Conference on Computer Innovations (NCC...

    2025

  14. [22]

    Google. 2018. gVisor: Application Kernel for Containers.https:// github.com/google/gvisor.https://gvisor.dev/

    2018

  15. [23]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. InProceedings of the 16th ACM Workshop on Artifi- cial Int...

    2023 doi

  16. [24]

    Invariant Labs. 2025. Invariant Guardrails Documentation.https: //github.com/invariantlabs-ai/invariant

    2025

  17. [25]

    Xiaojun Jia, Jie Liao, Simeng Qin, Jindong Gu, Wenqi Ren, Xi- aochun Cao, Yang Liu, and Philip Torr. 2026. SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents. arXiv:2602.14211https://arxiv.org/abs/2602.14211

    2026 arXiv

  18. [26]

    Yuxin Jiang, Yufei Wang, Xingshan Zeng, Wanjun Zhong, Liangyou Li, Fei Mi, Lifeng Shang, Xin Jiang, Qun Liu, and Wei Wang. 2024. Follow- Bench: A Multi-level Fine-grained Constraints Following Benchmark for Large Language Models. InProceedings of the 62nd Annual Meeting of the...

    2024 doi

  19. [27]

    Kemerlis, Georgios Portokalidis, Kangkook Jee, and An- gelos D

    Vasileios P. Kemerlis, Georgios Portokalidis, Kangkook Jee, and An- gelos D. Keromytis. 2012. libdft: Practical Dynamic Data Flow Track- ing for Commodity Systems. InProceedings of the 8th ACM SIG- PLAN/SIGOPS Conference on Virtual Execution Environments. Asso- ciation for Com...

    2012 doi

  20. [28]

    Frans Kaashoek, Eddie Kohler, and Robert Morris

    Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. 2007. Information Flow Control for Standard OS Abstractions. InProceedings of the 21st ACM SIGOPS Symposium on Operating Systems Principles (SOSP ’07). Association f...

    2007 doi

  21. [29]

    Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang

    Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. 2024. Lost in the Middle: How Language Models Use Long Contexts.Transactions of the Asso- ciation for Computational Linguistics12 (2024), 157–173. doi:10.1162/ tacl_a_00638

    2024

  22. [30]

    Zhang, Sebastian Baltes, and Christoph Treude

    Jai Lal Lulla, Seyedmoein Mohsenimofidi, Matthias Galster, Jie M. Zhang, Sebastian Baltes, and Christoph Treude. 2026. On the Impact of AGENTS.md Files on the Efficiency of AI Coding Agents. In Proceedings of the 1st Journal Ahead Workshop at the International Conference on So...

    2026

  23. [31]

    Narek Maloyan and Dmitry Namiot. 2026. Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems. arXiv:2601.17548https: //arxiv.org/abs/2601.17548

    2026

  24. [32]

    Max McGuinness, Mikaela Grace, Jiri De Jonghe, Jake Eaton, and Abel Ribbink. 2026. How We Contain Claude Across Products.https:// www.anthropic.com/engineering/how-we-contain-claude. Anthropic Engineering Blog, May 25, 2026

    2026

  25. [33]

    Yutao Mou, Zhangchi Xue, Lijun Li, Peiyang Liu, Shikun Zhang, Wei Ye, and Jing Shao. 2026. ToolSafe: Enhancing Tool Invocation Safety of LLM-based Agents via Proactive Step-Level Guardrail and Feed- back. arXiv:2601.10156https://arxiv.org/abs/2601.10156Accepted to Findings of ...

    2026

  26. [34]

    Holland, Uri Braun, and Margo Seltzer

    Kiran-Kumar Muniswamy-Reddy, David A. Holland, Uri Braun, and Margo Seltzer. 2006. Provenance-Aware Stor- age Systems. In2006 USENIX Annual Technical Conference (USENIX ATC 06). USENIX Association, Boston, MA, 43–56. https://www.usenix.org/conference/2006-usenix-annual-technic...

    2006

  27. [35]

    Andrew C. Myers. 1999. JFlow: Practical Mostly-Static Informa- tion Flow Control. InProceedings of the 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL ’99). As- sociation for Computing Machinery, New York, NY, USA, 228–241. doi:10.1145/292540.292561

    1999 doi

  28. [36]

    OpenAI. 2025. Codex CLI.https://github.com/openai/codex

    2025

  29. [37]

    OpenAI. 2026. GPT-5.5 System Card.https://openai.com/index/gpt-5- 5-system-card/. Published April 23, 2026; updated April 24, 2026

    2026

  30. [38]

    Thomas F. J.-M. Pasquier, Xueyuan Han, Thomas Moyer, Adam Bates, Olivier Hermant, David Eyers, Jean Bacon, and Margo Seltzer. 2018. Runtime Analysis of Whole-System Provenance. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. Association...

    2018 doi

  31. [39]

    Thomas F. J.-M. Pasquier, Jatinder Singh, David Eyers, and Jean Bacon

  32. [40]

    doi:10.1109/ TCC.2015.2489211

    CamFlow: Managed Data-Sharing for Cloud Services.IEEE Transactions on Cloud Computing5, 3 (2017), 472–484. doi:10.1109/ TCC.2015.2489211

    2017

  33. [41]

    Pohly, Stephen McLaughlin, Patrick McDaniel, and Kevin But- ler

    Devin J. Pohly, Stephen McLaughlin, Patrick McDaniel, and Kevin But- ler. 2012. Hi-Fi: Collecting High-Fidelity Whole-System Provenance. InProceedings of the 28th Annual Computer Security Applications Con- ference. Association for Computing Machinery, Orlando, FL, 259–268. doi...

    2012 doi

  34. [42]

    Yunjia Qi, Hao Peng, Xiaozhi Wang, Amy Xin, Youfeng Liu, Bin Xu, Lei Hou, and Juanzi Li. 2025. AGENTIF: Benchmarking Large Language Models Instruction Following Ability in Agentic Scenarios. InAdvances in Neural Information Processing Systems, Vol. 38. Curran Associates, Inc.h...

    2025

  35. [43]

    Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christo- pher Parisien, and Jonathan Cohen. 2023. NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. InProceedings of the 2023 Conference on Empirical Methods in Natural Languag...

    2023 doi

  36. [44]

    Santos, Vitor Costa, Joao Eduardo Montandon, and Marco Tulio Valente

    Helio Victor F. Santos, Vitor Costa, Joao Eduardo Montandon, and Marco Tulio Valente. 2026. Decoding the Configuration of AI Coding Agents: Insights from Claude Code Projects. InProceedings of the 2026 International Workshop on Agentic Engineering. Association for Computing Ma...

    2026

  37. [45]

    Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2025. Progent: Securing AI Agents with Privilege Control. arXiv:2504.11703.https://arxiv.org/abs/2504.11703

    2025 arXiv

  38. [46]

    The Linux Kernel Documentation. 2025. Landlock: Unprivileged Access Control.https://www.kernel.org/doc/html/latest/userspace- api/landlock.html

    2025

  39. [47]

    Vivek Trivedy. 2026. The Anatomy of an Agent Harness.https://www. langchain.com/blog/the-anatomy-of-an-agent-harness. Published March 10, 2026

    2026

  40. [48]

    Sanidhya Vijayvargiya, Aditya Bharat Soni, Xuhui Zhou, Zora Zhiruo Wang, Nouha Dziri, Graham Neubig, and Maarten Sap. 2026. OpenA- gentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety. InThe Fourteenth International Conference on Learning Representat...

    2026

  41. [49]

    Poskitt, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2026. AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. In2026 IEEE/ACM 48th International Conference on Software Engi- neering (ICSE). Association for Computing Machinery, New York, NY, USA, 12 pages...

    2026 arXiv

  42. [50]

    Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H

    Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Jun- yang Lin, Robert Bren...

    2025

  43. [51]

    Robert N. M. Watson, Jonathan Anderson, Ben Laurie, and Kris Ken- naway. 2010. Capsicum: Practical Capabilities for UNIX. In19th USENIX Security Symposium (USENIX Security 10). USENIX Associa- tion, Washington, DC, 29–46.https://www.usenix.org/conference/ usenixsecurity10/caps...

    2010

  44. [52]

    Tianyuan Wu, Chaokun Chang, Lunxi Cao, Wei Gao, and Wei Wang

  45. [53]

    arXiv:2604.28138 [cs.OS]https://arxiv.org/abs/2604

    Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes. arXiv:2604.28138 [cs.OS]https://arxiv.org/abs/2604. 28138

    arXiv

  46. [54]

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, Dawn Song, and Bo Li. 2025. GuardAgent: Safeguard LLM Agents via Knowledge- Enabled Reasoning. InProceedings of the 42nd International Con- ference on Machin...

    2025

  47. [55]

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, et al

  48. [56]

    arXiv:2505.09388.https://arxiv.org/ abs/2505.09388

    Qwen3 Technical Report. arXiv:2505.09388.https://arxiv.org/ abs/2505.09388

    arXiv

  49. [57]

    Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press

    John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. SWE-agent: Agent- Computer Interfaces Enable Automated Software Engineering. InAd- vances in Neural Information Processing Systems, Vol. 37. Curran As- sociates...

    2024 doi

  50. [58]

    Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda. 2007. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. InProceedings of the 14th ACM Conference on Computer and Communications Security. Association for Computing Machi...

    2007 doi

  51. [59]

    Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. 2006. Making Information Flow Explicit in HiStar. InPro- ceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’06). USENIX Association, Seattle, WA, 263– 278.https:/...

    2006

  52. [60]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. In- jecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Compu- tational Linguistics: ACL 2024. Association for Computational Linguis- ...

    2024 doi

  53. [61]

    Xing Zhang, Guanghui Wang, Yanwei Cui, Wei Qiu, Ziyuan Li, Bing Zhu, and Peiyang He. 2026. Guardrails Beat Guidance: A Large-Scale Study of Rules, Skills, and Persistent Configuration for Coding Agents. arXiv:2604.11088 [cs.SE]

    2026 arXiv

  54. [62]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhang- hao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena. InAdvances in Neural Information ...

    2023 doi

  55. [63]

    source" IDENT

    Yusheng Zheng, Yanpeng Hu, Tong Yu, and Andi Quinn. 2025. AgentSight: System-Level Observability for AI Agents Using eBPF. In Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems. Association for Computing Machinery, Seoul, Republic of Korea, 110–...

    2025 doi

Pith tools

Reviewed July 2, 2026 · model on record in the stance chip above.