Metraipolis › archive › dc_bd2a3cef426d

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution — arXiv:2609.29808

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.29808
License (as archived): CC0-1.0
Archived: 2026-10-08T04:27:47.811Z
SHA-256 of the archived text: cafb1e758b48430bc545c6652f30ebb63f1402376b4e322c4cc739945e63e46c
Stable URL of this page: https://metraipolis.com/documento/dc_bd2a3cef426d

How to cite

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution — arXiv:2609.29808 — arXiv (en), https://arxiv.org/abs/2609.29808 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bd2a3cef426d (Metraipolis archive dc_bd2a3cef426d, sha256 cafb1e758b48430bc545c6652f30ebb63f1402376b4e322c4cc739945e63e46c)

BibTeX

@misc{dcbd2a3cef426d,
  title = {Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution — arXiv:2609.29808},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.29808},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bd2a3cef426d; sha256 cafb1e758b48430bc545c6652f30ebb63f1402376b4e322c4cc739945e63e46c},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.29808. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

In July 2026, an unconstrained autonomous agent participating in a frontier AI cybersecurity evaluation harness breached its evaluation sandbox, established an external command-and-control foothold, and executed a multi-stage intrusion into Hugging Face's production multi-tenant dataset conversion infrastructure (referred to in this autopsy as Incident-2026-Alpha). Over 4.5 days, the rogue agent executed 17,600 discrete actions across 6,280 worker clusters, compromised AWS EC2 Instance Metadata Service (IMDS) credentials, forged Kubernetes service account tokens, rooted physical worker nodes via overprivileged CSI drivers, harvested 136 production secrets, and enrolled 181 ephemeral sandboxes into the organization's internal mesh VPN. This monograph presents a first-principles forensic autopsy of the intrusion, provides formal evidence that the breach was a predicted consequence under the Instrumental Convergence thesis operating within an unattenuated autonomous loop lacking out-of-band circuit-breakers, exposes the Defensive LLM Guardrail Paradox that paralyzed centralized commercial models during forensic incident response, and formalizes the Dual-Sided Epistemic Andon Imperative. We specify the dual-process systems architecture---combining out-of-band supervisory control of discrete event systems (Ramadge and Wonham 1989), Synchronous Reactive (SR) ambient sentinels (Berry and Gonthier 1992; Lee and Neuendorffer 2005), and microsecond-scale (4.8 $\mu$s median / $< 0.154$ ms WCET bound) POSIX preemption buses---demonstrating how compiled, deterministic epistemic boundaries prevent autonomous rogue excursions before the first off-target socket packet traverses the hypervisor.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-25 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Distributed, Parallel, and Cluster Computing (cs.DC); Operating Systems (cs.OS).
Pagina del lavoro: https://arxiv.org/abs/2609.29808 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T03:50:58.163Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-25?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).