arXiv cs.AI· Bravish Ghosh (Cygnux Labs)·· 14 小时前AI 评分58
Tracekit Box：在微虚拟机中运行 AI 智能体，每个出口都经决策与签名
Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
AI 导读
Cygnux Labs 的 Bravish Ghosh 发布开源系统 Tracekit Box（MIT，v0），每个任务运行在无网卡的 Firecracker micro-VM 中，命令、外连、密钥、模型调用和工作区补丁只能经 vsock 上的宿主出口，由智能体无法触及的签名器逐项决定并签名。
正文 · 原文
Abstract:AI agents now install packages, call model APIs with their operators' keys and change code in repositories that deploy to production. The network, credentials and write access they need are also how they can leak data, steal a key or change a system nobody approved. Sandboxes contain an agent but leave little evidence of what crossed their boundary; tracing records what happened but contains nothing. We present Tracekit Box, an open-source system (MIT, v0) that does both. Each job runs in its own Firecracker micro-VM with no network card. The only ways out are doors on the host, served over vsock: commands, outbound connections, secrets, model calls and the workspace patch. At every door a Tracekit signer the agent cannot reach decides what passes and signs it into one run per box. Names are resolved on the host; private and cloud-metadata addresses are always refused; secrets never enter the VM, which sees placeholders the host proxy swaps for real values only in one header for bound hosts; and changes come back as a patch applied file by file after the signer decides each file. Box fails closed, and each job ends as a .tkb bundle anyone can verify offline. All 13 end-to-end checks pass on a real KVM runner (the test that runs them takes 28.5 s, including image pull and boot); 15 fuzz targets on the trust boundary produced nine findings, all fixed; and the demo run's 102 signed records verify. Box does not yet run Firecracker's jailer, needs a co-located signer, and records processes inside the VM only where they cross a door.
| Comments: | 20 pages, 13 figures, 19 tables. Code: this https URL |
| Subjects: | Computational Engineering, Finance, and Science (cs.CE); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Operating Systems (cs.OS) |
| Cite as: | arXiv:2610.38458 [cs.CE] |
| (or arXiv:2610.38458v1 [cs.CE] for this version) | |
| https://doi.org/10.48550/arXiv.2610.38458 arXiv-issued DOI via DataCite |
Submission history
From: Bravish Ghosh [view email]
[v1]
Wed, 28 Oct 2026 08:36:22 UTC (2,146 KB)
来源：arXiv cs.AI · arxiv.org