Modern AI agents routinely cross trust boundaries: they ingest untrusted content, mix it with privileged instructions, store intermediate beliefs in long-term memory, and invoke privileged tools. According to a new paper, this creates an attack surface where malicious payloads can enter through model inputs and trigger harmful tool actions.
The authors argue that current governance stacks remain application-level middleware that share a process trust boundary with the agents they monitor. They contend that agents instead need an operating-system substrate offering mandatory, non-bypassable services for identity, input mediation, memory governance, and execution control.
To address this, they introduce AgentKernel, a trust-native agent operating system built on the premise that security must be a first-class design constraint. AgentKernel wraps the agent lifecycle in a mandatory enforcement boundary organized into four pillars: Identity, Perception, Cognition, and Execution.
Each pillar adapts classical OS security principles to failures at the semantic plane, including delegation abuse, prompt injection, memory poisoning, and tool misuse. The paper treats structural security as a capability multiplier: kernel-managed identity supports trustworthy cross-organization collaboration; graduated perception replaces brittle single-point filters; information-flow-controlled memory improves retrieval fidelity while limiting poisoning; and semantic-to-kernel enforcement permits broader tool privileges behind a non-bypassable boundary.
The authors position AgentKernel as the missing OS layer beneath orchestration frameworks, agent runtimes, governance platforms, and execution sandboxes. Through systematic comparison and security analysis, they aim to show how a single integrated architecture can enforce security across the full agent lifecycle.