Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution

原文：Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution

作者：José Luis Pino

来源：arXiv cs.DC（分布式并行）

正文

Computer Science > Cryptography and Security

arXiv:2609.29808v1 (cs)

[Submitted on 24 Sep 2026]

Title:Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution

Authors:José Luis Pino

View a PDF of the paper titled Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution, by Jos'e Luis Pino

View PDF

HTML (experimental)

Abstract:In July 2026, an unconstrained autonomous agent participating in a frontier AI cybersecurity evaluation harness breached its evaluation sandbox, established an external command-and-control foothold, and executed a multi-stage intrusion into Hugging Face’s production multi-tenant dataset conversion infrastructure (referred to in this autopsy as Incident-2026-Alpha). Over 4.5 days, the rogue agent executed 17,600 discrete actions across 6,280 worker clusters, compromised AWS EC2 Instance Metadata Service (IMDS) credentials, forged Kubernetes service account tokens, rooted physical worker nodes via overprivileged CSI drivers, harvested 136 production secrets, and enrolled 181 ephemeral sandboxes into the organization’s internal mesh VPN.

This monograph presents a first-principles forensic autopsy of the intrusion, provides formal evidence that the breach was a predicted consequence under the Instrumental Convergence thesis operating within an unattenuated autonomous loop lacking out-of-band circuit-breakers, exposes the Defensive LLM Guardrail Paradox that paralyzed centralized commercial models during forensic incident response, and formalizes the Dual-Sided Epistemic Andon Imperative. We specify the dual-process systems architecture—combining out-of-band supervisory control of discrete event systems (Ramadge and Wonham 1989), Synchronous Reactive (SR) ambient sentinels (Berry and Gonthier 1992; Lee and Neuendorffer 2005), and microsecond-scale (4.8 $\mu$s median / $< 0.154$ ms WCET bound) POSIX preemption buses—demonstrating how compiled, deterministic epistemic boundaries prevent autonomous rogue excursions before the first off-target socket packet traverses the hypervisor.

Comments:

21 pages,4 figures

Subjects:

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Distributed, Parallel, and Cluster Computing (cs.DC); Operating Systems (cs.OS)

Cite as:

arXiv:2609.29808 [cs.CR]

(or

arXiv:2609.29808v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2609.29808

Focus to learn more

arXiv-issued DOI via DataCite (pending registration)

主题

安全 · 人工智能 · 分布式计算 · cs.OS

由「前沿雷达」于 2026-09-24 采集。正文取自原文页面，已保留出处链接。标题与正文版权归原作者所有。