Rather than judging each action in isolation, Kairos puts an agent’s ambiguous effects on hold and lets the rest of the trail decide, without compromising its usefulness.
Development agents act with the authority of their user, which makes them a prime target for indirect prompt injection: any data read can hide a malicious instruction, and the model does not reliably differentiate between them. The authors of Kairos, published on arXiv on October 13, 2026, therefore propose not to monitor the model but the effects it produces, at the isolation boundary of an agent left as is.
Postponing rather than deciding too soon
At this boundary, a tool call, a shell command, or a script written by the agent all boils down to operations on files and the network. A declarative policy indicating trusted sources settles most cases deterministically; the rest are put on hold while the agent continues to work speculatively. An "oracle" with limited powers, a language model or human, then decides whether to release or block each effect based on the continuation of the trace, where the start of an attack and legitimate work finally stand out.
Evaluated on three benchmarks and with three agent models, Kairos offers the best compromise between security and utility, according to its authors: on AgentDojo, the rate of successful attacks drops from 47.0% to 2.7%, while the usefulness on legitimate tasks remains at the level of an unprotected agent.
Read the full article on the original source
Go to the source →