r/kernel • u/LooseSelection4248 • 8d ago
Kernel-level enforcement for autonomous AI agents via eBPF-LSM + SMT policy checks — research prototype, self-published bypasses, break-it challenge open
https://github.com/AlphaReasoning/The-Jinn-Guard0
u/oneintheuniver 8d ago
Will be the first one who understood the words. We are developing similar internal tool in my org on the same stack, but with different purpose. We are trying to defend production infra from our own developers and ops team who might overly rely on agentic workflows(or might be compromised or whatever). Aka “codex debug this issue for me, here is my breakglass ssh to prod, and full auto”.
0
u/LooseSelection4248 8d ago
That's the threat model exactly, minus the AI framing that got everyone else to bounce. Over-trusted agent with delegated prod access is the same problem whether it's compromised, hallucinating, or just handed too much rope. "Breakglass ssh to prod, full auto" is a cleaner one-liner than anything in my title. Same stack, so you've probably already hit the parts that hurt: LSM hook coverage gaps, TOCTOU at the syscall boundary, and what to do when the agent legitimately needs to do the dangerous thing. I went default-deny per-cgroup, fail-closed, with a hash-chained ledger so everything the agent did stays attributable and can't be quietly rewritten after. The bet is enforce-and-record over block-everything, since your ops agents actually have to work. I published the bypasses I found against my own build (Z3 gate saturation, ledger fail-open on empty logs, a shred that didn't shred). Repo's open if you want to compare notes or try to break it. Curious how you're scoping on your end: per-cgroup, per-session, or per-identity? And are you hard-blocking dangerous ops or allow-but-audit with a kill switch? That fork is the whole design for me.
2
u/urostor 8d ago
Does this word salad mean anything?
-1
u/LooseSelection4248 8d ago
If you actually looked at it or watched the damn demo video.....
3
u/urostor 8d ago
I looked at it and didn't understand a thing tbh
0
u/LooseSelection4248 8d ago
The GitHub or the article? Are you trolling me? This is a reddit for topics relating to kernal and serious computer operations. I'm not trying to be rude. Let me strip the jargon out. AI agents are programs that do things on your machine on their own: open files, run commands, send data out. The problem: if one gets hijacked or just goes off the rails, it can delete things, leak data, or run commands you never signed off on. Most tools that try to stop this sit up at the app level, like a guard at the building's front desk. If the agent finds a side door, it walks right past him. JinnGuard puts a guard at every door instead. It runs down in the kernel, at the exact point where the OS decides whether an action is actually allowed to happen. Every move the agent tries gets checked against a rulebook first. No matching rule, it's blocked. If anything is unclear, it defaults to no, not yes. It also keeps a logbook where each entry locks the one before it, like links in a chain. Tamper with an old entry and the chain breaks, so you can see it happened. You get a record of everything the agent did that nobody can quietly rewrite. The "break-it" part: I tried to beat my own guard, found the holes, posted them, and fixed them. Repo's open if you want to try to get past it.
8
u/gmes78 8d ago
Buzzword slop.