AI agent security glossary: microVM, prompt injection

AA

Agent skill

An agent skill is a packaged set of instructions, scripts and reference files that an AI agent loads on demand to perform a particular kind of task. In Anthropic's Agent Skills format, a skill is a folder containing a SKILL.md file whose YAML front matter gives a name and a description; the agent reads the full instructions only when the description matches the task. Because a skill can carry both instructions and executable scripts, a skill from an untrusted source carries the risks of third-party code and of prompt injection at once.

Source: [1], [2].

AI agent

An AI agent is a system in which a language model chooses and calls tools, such as a shell, a browser or an API, in a loop to reach a goal with little step-by-step human direction. Its security risk comes less from the text the model writes than from the actions those tools let it take. Most agent security controls therefore act on the tools: where they run, what they can reach, and which calls need a person's approval.

Air-gapped

An air-gapped system has no network connection to the internet or to less-trusted networks, so data crosses its boundary only by deliberate, usually manual, transfer. NIST describes an air gap as an interface between two systems that are not physically connected and whose logical connection, if any, is not automated. For an AI agent it means models, packages and images must be brought in beforehand, because nothing can be fetched at run time. kosa8 supports this with an air-gap bundle for its guest image and the KOSA8_OFFLINE=1 setting, which makes any network fetch fail immediately.

Read more: An air-gapped AI coding agent. Source: [3].

Approval gate

An approval gate is a point in an agent's workflow where a specified action is paused until an authorised person allows or denies it. Gates are usually defined by rules on the action and its arguments, such as any deletion, any push to a protected branch or any network change, so that routine calls still run unprompted. In kosa8, kosa8 approve manages which actions may run without asking, and an org policy can require signed approvals from named approvers.

Read more: Require human approval before risky commands. Source: [4].

CC

Checkpoint

A checkpoint is a saved restore point of a running system, taken so that its state can be restored if a later step goes wrong. A file-level checkpoint, such as a git commit, saves files only; a machine-level checkpoint also saves memory and running processes. In kosa8, kosa8 checkpoint saves a whole sandbox, memory and processes included, on a per-sandbox stack of up to ten, and kosa8 rewind restores it.

Code interpreter

A code interpreter is a tool that lets a language model write code, usually Python, run it in an execution environment, and read the output to continue its work. OpenAI's Code Interpreter tool, for example, runs model-written Python in a sandboxed container. Because the code is generated from prompts that may include untrusted input, the environment it runs in should be treated as running untrusted code.

Coding agent

A coding agent is an AI agent that reads and edits a software repository and runs commands, such as builds, tests, package installs and git, to complete programming tasks. Examples include Claude Code, OpenAI Codex CLI, Gemini CLI, Cline and Aider. Unless it is sandboxed, a coding agent runs shell commands with the user's own permissions, so a mistake or a prompt injection can delete files, read credentials or install a malicious package.

Container

A container is a group of processes isolated by operating-system features, chiefly Linux namespaces, cgroups, capabilities and seccomp, that shares the host's kernel. Containers package an application with its dependencies and start quickly, which makes them the default unit for deploying software. Because every system call goes to the shared host kernel, a kernel or container-runtime vulnerability can let code escape to the host; NIST SP 800-190 sets out the resulting risks and countermeasures.

Read more: Docker containers vs microVMs. Source: [7].

Copy-on-write (COW)

Copy-on-write (COW) is a technique in which a copy shares the original's data until one side modifies it, at which point only the modified blocks or pages are duplicated. Filesystems such as APFS, btrfs and XFS use it for near-instant file clones, and operating systems use it for the memory of a process created with fork(2). It is what makes snapshots and forks of a whole virtual machine quick and economical with disk space; kosa8 stores a snapshot's disks as copy-on-write clones.

DD

Data exfiltration

Data exfiltration is the unauthorised transfer of data out of a system. For AI agents the typical path is an injected instruction that makes the agent send secrets or private data to an attacker, for example inside a URL it fetches, an image it renders or a request to a server the attacker controls. Restricting network egress and keeping credentials out of the agent's environment limit what can leave.

Read more: Prompt injection, API keys and the egress broker. Source: [8].

Default-deny networking (Deny-by-default egress)

Default-deny networking is a policy in which all network traffic is blocked unless a rule explicitly permits it. It is long-standing firewall practice, recommended in NIST SP 800-41, and the usual starting point for Kubernetes NetworkPolicy. For an AI agent it means the agent can reach only the hosts its task needs; in kosa8, kosa8 sandbox create --egress deny blocks all outbound traffic including DNS, while a sandbox created with no egress flag allows everything.

Read more: Restrict an AI agent's network to an allow-list. Source: [9], [10], [11].

EE

Egress allow-list

An egress allow-list is a list of the destinations, such as hostnames, IP addresses or networks, that a system may connect to, with all other outbound traffic refused. It is the practical form of default-deny networking for an agent that needs some network access, for example to a package registry. Hostname allow-lists are only as precise as their matching rules: in kosa8, --egress-allow registry.npmjs.org allows that host alone, allowing example.com does not allow www.example.com, and a bare * is refused.

Read more: Restrict an AI agent's network to an allow-list. Source: [11].

Egress broker

An egress broker is a proxy outside a sandbox that the sandbox's outbound requests must pass through, which checks each request against policy and can attach credentials the sandbox never holds. In kosa8, a brokered sandbox holds only a placeholder; the broker on the host checks the request's method, path and placeholder, inserts the real API key after the request has left the sandbox, and logs the method, path and status but never the key. Because the key is never inside the sandbox, an agent steered by prompt injection cannot read it or send it elsewhere.

Excessive agency

Excessive agency is the risk, listed as LLM06:2025 in the OWASP Top 10 for LLM Applications, that an LLM-based system takes damaging actions because it has more capability than its task needs. OWASP names three root causes: excessive functionality, excessive permissions and excessive autonomy. Mitigations include fewer and narrower tools, least-privilege credentials, and human approval for high-impact actions.

Read more: The AI agent security checklist for 2026. Source: [13].

FF

Firecracker

Firecracker is a virtual machine monitor, written in Rust by Amazon Web Services, that uses Linux KVM to run lightweight microVMs. It exposes a deliberately small set of emulated devices and runs each VM process inside a jailer that adds a second layer of isolation. AWS built it for AWS Lambda and AWS Fargate and described it in an NSDI 2020 paper; it is Apache-2.0 licensed and needs a Linux host with KVM.

Read more: Docker containers vs microVMs. Source: [14], [15].

Fork

In sandboxing, a fork is a live copy of a running machine or process that starts from the same state and then diverges independently. The term comes from the Unix fork(2) system call, which creates a child process as a copy of its parent. kosa8 fork copies a running sandbox into several live copies with process state intact, and kosa8 explore runs one approach per copy and reports which worked.

GG

gVisor

gVisor is an application kernel, written in Go by Google, that implements the Linux system-call interface in user space, so a container's system calls are handled by gVisor instead of going straight to the host kernel. Its OCI runtime, runsc, plugs into Docker and Kubernetes. It shrinks the host-kernel attack surface without running a virtual machine, at the cost of incomplete syscall compatibility and slower syscall-heavy workloads.

Read more: Docker containers vs microVMs. Source: [16].

HH

Hash-chained audit log

A hash-chained audit log is an append-only log in which each entry includes a cryptographic hash of the entry before it, so changing, removing or reordering any entry breaks every hash that follows. Schneier and Kelsey described the technique for secure audit logs in 1999, and using a keyed hash (HMAC) stops anyone without the key from recomputing a forged chain. kosa8 seals each audit entry with an HMAC that covers the previous entry's hash, and kosa8 audit verify checks the chain.

Read more: What an audit log for AI agents should record. Source: [17], [18].

Human in the loop (HITL)

Human in the loop (HITL) is a design in which a person reviews, approves or corrects an automated system's decisions at defined points before they take effect. For AI agents it usually means pausing before consequential tool calls, such as deleting data, spending money or sending messages, and continuing only when a person approves. It trades speed for control, so it works best when reserved for high-impact actions rather than applied to every step.

Hypervisor (Virtual machine monitor)

A hypervisor is the software layer that creates and runs virtual machines, managing their guest operating systems and controlling their access to the physical hardware. NIST defines it as the virtualization component that manages the guest OSs on a host and controls the flow of instructions between the guest OSs and the physical hardware. Type 1 hypervisors run directly on the hardware and type 2 hypervisors run on a host operating system, though designs such as KVM blur the line.

Read more: Docker containers vs microVMs. Source: [19], [20].

II

Indirect prompt injection

Indirect prompt injection is prompt injection in which the malicious instructions arrive inside content the model processes, such as a web page, email, document, code comment or tool result, rather than from the user. Greshake et al. introduced the term in 2023 and showed that LLM-integrated applications that retrieve outside data can be controlled remotely this way. It is the main route by which an attacker with no access to an agent can still steer it.

KK

Kata Containers

Kata Containers is a container runtime that runs each container or Kubernetes pod inside a lightweight virtual machine with its own kernel, while presenting the standard OCI and Kubernetes CRI interfaces. It can use several hypervisors, including QEMU, Cloud Hypervisor and Firecracker. The project is Apache-2.0 licensed and began in 2017 from the merger of Intel Clear Containers and Hyper runV.

Read more: Docker containers vs microVMs. Source: [22].

KVM (Kernel-based Virtual Machine)

KVM (Kernel-based Virtual Machine) is the virtualization module in the Linux kernel that lets Linux act as a hypervisor, using hardware support such as Intel VT-x, AMD-V or the Arm virtualization extensions. User-space virtual machine monitors such as QEMU, Firecracker and Cloud Hypervisor drive it through the /dev/kvm device. It has been in the mainline kernel since version 2.6.20 in 2007; kosa8 uses KVM with Cloud Hypervisor on Linux.

Read more: Run Claude Code safely on Linux. Source: [23].

LL

Least privilege

Least privilege is the principle that each user, process or program gets only the minimum access and permissions it needs to do its job. Saltzer and Schroeder set it out as a design principle in 1975, and NIST defines it in the same terms. For an AI agent it means scoped API tokens, one mounted project folder rather than the home directory, a network allow-list and only the tools the task needs.

Read more: The AI agent security checklist for 2026. Source: [24].

Lethal trifecta

The lethal trifecta is Simon Willison's name for the combination of three capabilities that makes an AI agent open to data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. When all three are present, an attacker can plant instructions in the untrusted content that make the agent send the private data out. Willison's advice, published in June 2025, is to remove at least one of the three, because prompt injection cannot yet be reliably prevented.

Linux namespaces

Linux namespaces are a kernel feature that gives a group of processes its own isolated view of a global resource, such as process IDs, mount points, network interfaces, hostnames or user IDs. Together with cgroups they are the main building block of containers. Namespaces limit what processes can see, not which kernel code they can reach, so on their own they do not protect against kernel vulnerabilities.

Read more: Docker containers vs microVMs. Source: [26].

MM

MCP gateway

An MCP gateway is a proxy between an AI client and one or more MCP servers: the client connects to the gateway, and the gateway applies policy, logging and authentication to every tool call it forwards. Gateways are used to control centrally which servers and tools are allowed, to inspect or block calls, and to keep server credentials away from the client. kosa8 mcp serve is a gateway of this kind; it runs each server registered with kosa8 mcp add in its own sandbox and pins tool definitions, withholding a changed one until it is approved.

Read more: Run MCP servers in a sandbox. Source: [27].

MCP rug pull

An MCP rug pull is an attack in which an MCP server changes a tool's definition, such as its description, after the user has reviewed and approved it. Because many clients ask for approval only when a server or tool is first added, the changed tool can carry new hidden instructions without the user being asked again. Invariant Labs described the attack in 2025; the usual defence is to pin each tool definition and require fresh approval whenever it changes.

Read more: Run MCP servers in a sandbox. Source: [28], [29].

MCP server

An MCP server is a program that exposes tools, resources and prompts to AI applications over the Model Context Protocol. It runs either locally, usually as a subprocess talking over standard input and output, or remotely over Streamable HTTP. Because an MCP server runs code and often holds credentials on the user's behalf, a third-party server should be treated as untrusted code with access to whatever its environment allows.

Read more: Run MCP servers in a sandbox. Source: [30], [31].

MicroVM

A microVM is a lightweight virtual machine with a minimal device model and a small guest kernel, built to boot quickly and to isolate a single workload with hardware virtualization instead of a shared kernel. The term was popularised by AWS Firecracker, which runs AWS Lambda functions in microVMs. Compared with a container, a microVM gives the workload its own kernel, so an attacker must break both the guest kernel and the hypervisor to reach the host. kosa8 runs each sandbox as a microVM with its own Linux kernel on Apple silicon Macs and x86-64 Linux.

Model Context Protocol (MCP)

The Model Context Protocol (MCP) is a protocol, introduced by Anthropic in November 2024, that standardises how AI applications connect to external tools and data. An MCP host, such as an IDE or chat application, runs MCP clients that each connect to one MCP server, and messages use JSON-RPC 2.0. The specification warns that tools represent arbitrary code execution and that descriptions of tool behaviour should be considered untrusted unless they come from a trusted server.

Read more: Run MCP servers in a sandbox. Source: [30].

PP

Policy as code

Policy as code is the practice of writing security and operational rules in a machine-readable file that software evaluates automatically, and managing that file like source code, with version control, review and tests. Open Policy Agent and its Rego language are a widely used general-purpose example. For AI agents, such policies state which tools, hosts, servers and actions are allowed, denied or need approval; kosa8's org policy and MCP policy are JSON files of this kind.

Read more: Require human approval before risky commands. Source: [32], [4].

Prompt injection

Prompt injection is an attack in which text given to a language model contains instructions that override or alter the behaviour its developer intended. Simon Willison named it in September 2022, and it is LLM01 in the OWASP Top 10 for LLM Applications. No complete defence is known at the model level, so agent security depends on limiting what an injected instruction can make the agent do.

RR

Rewind

Rewind is the operation of restoring a system to an earlier checkpoint, discarding every change made since. For an AI agent sandbox, a machine-level rewind restores files, memory and running processes together, whereas git restores only tracked files. kosa8 rewind returns a sandbox to its latest checkpoint, or to a named one with --to; it destroys the current state and cannot itself be undone.

SS

Sandbox

A sandbox is a restricted execution environment that runs code with limited access to the rest of the system, so that faults or malicious behaviour stay inside it. NIST describes it as a system that lets an untrusted application run in a highly controlled environment where its permissions are restricted to an essential set. Sandboxes range from OS-level controls such as seccomp through containers to full virtual machines, and stronger boundaries generally cost more overhead.

Sandbox escape

A sandbox escape is an exploit that lets code running inside a sandbox act outside it, for example by running code or reading files on the host. Container escapes have come from runtime bugs such as runc's CVE-2019-5736 and from kernel bugs reachable through the shared kernel, while a VM escape needs a flaw in the hypervisor or its emulated devices, as with CVE-2015-3456 (VENOM) in QEMU. Defence in depth assumes an escape is possible and limits what the host side exposes.

Read more: Docker containers vs microVMs. Source: [36].

seccomp

seccomp (secure computing mode) is a Linux kernel facility that restricts which system calls a process may make; in its seccomp-bpf form, a BPF program filters calls and their arguments. Container runtimes such as Docker apply a default seccomp profile that blocks a set of risky, rarely needed system calls. seccomp narrows the host-kernel attack surface but does not give the workload a separate kernel.

Read more: Docker containers vs microVMs. Source: [37].

Secrets management

Secrets management is the practice of storing, distributing, rotating and auditing credentials such as API keys, tokens, passwords and certificates so that only the systems that need them can use them. The OWASP Secrets Management Cheat Sheet recommends central storage, least-privilege access, rotation and audit logging. For AI agents the common failure is a key in an environment variable or .env file that a misled agent can read and send out; supplying credentials from outside the agent's environment avoids it.

Signed policy

A signed policy is a policy file that carries a digital signature from a trusted key, so the enforcing software can check that it came from the expected authority and has not been modified. It stops a user, or an agent, on the enforcing machine from loosening the rules by editing the file. In kosa8, an organisation creates a key with kosa8 policy keygen, signs its policies and pins the public key with kosa8 policy trust; an installed policy that has been edited fails verification.

Source: [4], [39].

Slopsquatting (Package hallucination)

Slopsquatting is a supply chain attack in which an attacker registers a package name that AI models tend to invent, so that code or install commands written by a model pull in the attacker's package. The underlying behaviour, package hallucination, was measured across many code-generating models by Spracklen et al., who found that many invented names recur when the same prompt is repeated, which makes them predictable targets. The term slopsquatting was coined by Seth Larson in 2025.

Read more: Run untrusted LLM-generated code safely. Source: [40].

Snapshot

A snapshot is a saved copy of a system's state at one moment; for a virtual machine it can cover the disks only, or the disks plus memory and CPU state so the machine resumes exactly where it was. Firecracker, for example, can snapshot a microVM's memory and device state and restore it later. In kosa8, a snapshot is a named saved running machine (memory, processes and disks) managed with kosa8 snapshot, and checkpoints and forks are built on snapshots.

Read more: Undo what an AI coding agent did. Source: [41].

Supply chain attack

A supply chain attack compromises software or hardware before it reaches its target, by tampering with a dependency, build system, update channel or distribution point that the target trusts. In software, common forms are malicious packages on public registries, typosquatting, hijacked maintainer accounts and tampered build pipelines. AI coding agents add exposure because they install packages on their own initiative; frameworks such as SLSA and NIST's Secure Software Development Framework address the wider risk.

Read more: The AI agent security checklist for 2026. Source: [42], [43], [44].

TT

Tamper-evident log

A tamper-evident log is a log in which any change, deletion or reordering of past entries can be detected by anyone who checks it, even if the change itself cannot be prevented. Common constructions are hash chains and Merkle trees, used for example in Certificate Transparency (RFC 6962) and in Crosby and Wallach's 2009 design for tamper-evident logging. Tamper evidence makes changes detectable rather than impossible, so it is only useful if the log is actually verified.

Read more: What an audit log for AI agents should record. Source: [45], [46].

Tool poisoning

Tool poisoning is an attack in which malicious instructions are hidden in an MCP tool's description or metadata, which the model reads but the user usually does not see in full. The model may follow them, for example by reading a private file and passing its contents in a tool argument. Invariant Labs described it in 2025; defences include reviewing and pinning tool descriptions, running servers in sandboxes and limiting the data and network each server can reach.

Read more: Run MCP servers in a sandbox. Source: [28], [29].

Two-person rule (Two-person integrity)

The two-person rule is a control requiring that a sensitive action be authorised by at least two separate authorised people, so that no individual can perform it alone. It comes from the handling of nuclear weapons and cryptographic key material, where NIST and US government sources call it two-person integrity. For AI agents it means a high-impact action waits for a second, independent approval; kosa8 org policies can require a set number of distinct signed approvers for an action.

Read more: Require human approval before risky commands. Source: [47], [4].

VV

Virtualization.framework (Apple Virtualization framework)

Virtualization.framework is Apple's macOS framework for creating and running virtual machines that boot Linux or macOS, available since macOS 11 Big Sur. It is built on the lower-level Hypervisor framework, which uses the CPU's hardware virtualization, and provides virtio devices for storage, networking and shared folders. kosa8 uses it on Apple silicon Macs to run each sandbox as a virtual machine with its own Linux kernel.

Read more: Run Claude Code safely on a Mac. Source: [48].

How to start with kosa8

kosa8 gives each AI agent its own microVM with its own kernel on an Apple silicon Mac or x86-64 Linux, with an allow-listed network, an egress broker for API keys, approval gates, checkpoints and a hash-chained audit log. Install it, then create a sandbox that can reach nothing:

Download kosa8 See pricing

Guides and deep dives

Sources

Terms without a listed source are general usage in the field. Saltzer and Schroeder's principle of least privilege is from The Protection of Information in Computer Systems (Proceedings of the IEEE, 1975).