kosa8 Labs · Technical report K8-TR-2026-01 · 17 October 2026
Sealed Machines for Autonomous Agents
Design, security analysis and evaluation of kosa8, a local-first security infrastructure for AI agents. We describe the system, set out a threat model in which the attacker is root inside the agent's machine, measure kosa8 v0.9.36 on real hardware, and compare it with ten other agent sandboxes against thirteen requirements for regulated use.
01Abstract
Large-language-model agents now execute code, install dependencies, call tools and act on production systems. Model-level defences against prompt injection fail under adaptive attack, so an organisation must assume that some agent will, at some point, be steered by an adversary. What remains is the question of what the agent can do once that happens. kosa8 answers it with containment and proof rather than detection.
- Every agent runs in its own hardware-virtualised microVM, with its own kernel, on hardware the customer controls.
- The network is enforced on the host, frame by frame.
- API keys never enter the agent's machine.
- Any running machine can be checkpointed, rewound or forked in place.
- Risky actions wait for one or two named people to approve them.
- Every decision goes into a keyed, hash-chained audit log, which exports as a signed evidence package anyone can verify offline.
02Key results
- kosa8 is the only system of the eleven compared that fully meets all thirteen requirements for agents in regulated settings. The next most complete systems fully meet four.
- On the host, kosa8 blocked every network destination outside policy across four policy modes. That includes raw IPv6, cloud-metadata and gateway addresses.
- 9.0 million fuzzing runs against the parsers an attacker can reach produced no crash or hang.
- kosa8 contains or fully handles all eight attack-and-recovery scenarios studied. They range from lethal-trifecta exfiltration and MCP rug pulls to an assessor audit and an air-gapped site.
- The report also states plainly where kosa8 does not yet lead, including sandbox creation time and third-party attestation.
03Requirements scorecard
As documented on 17 October 2026. Third-party products are assessed from their public documentation.
04Architecture
05What the paper covers
- Threat model and eight security goals, with the attacker as root inside the guest
- Design: microVM isolation, host-side egress, credential broker, checkpoint, rewind and fork, two-person approvals, governed MCP gateway, tamper-evident audit log, evidence and air-gap
- Security analysis of each goal, with its residual risk
- Evaluation of kosa8 v0.9.36: tests, fuzzing, egress probes and latency
- Comparison with ten systems across thirteen requirements and eight scenarios
- Limitations, related work and 71 references
© 2026 kosa8 Labs. All rights reserved. Published for reading only; no part may be copied, redistributed or republished without written permission. Questions: contact@kosa8.com.