Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels

Biao Gao; David Levitsky; Gan Fang; Qiancheng Wu; Rob Cameron; Shawna Murphy Butterworth; Sheng Mao; Wenhui Zhang

arxiv: 2605.27488 · v2 · pith:ZJ5TEYUOnew · submitted 2026-05-26 · 💻 cs.CR · cs.AI

Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels

Qiancheng Wu , Wenhui Zhang , Gan Fang , Sheng Mao , Biao Gao , David Levitsky , Shawna Murphy Butterworth , Rob Cameron This is my paper

Pith reviewed 2026-06-29 17:21 UTC · model grok-4.3

classification 💻 cs.CR cs.AI

keywords eBPFTLS attestationagent securitysandbox guardscope tokenskernel enforcementmulti-cloud communicationdelegation

0 comments

The pith

Grimlock shifts security enforcement for agent communication into the Linux kernel with eBPF interception and TLS-bound attestations.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Agentic systems embed identity, authorization, and delegation logic in user-authored orchestration code, where consistent enforcement becomes difficult. Grimlock addresses this by moving trust decisions into the sandbox substrate using commodity Linux mechanisms. It forces all communication through an eBPF guard that performs post-handshake attestation tied to TLS 1.3 channel bindings and issues short-lived scope tokens for least-privilege access. The receiving guard re-validates the binding before releasing plaintext. This produces auditable, scope-bound agent-to-agent exchanges across multi-cloud setups while leaving application code untouched.

Core claim

Grimlock uses eBPF-enforced traffic interception to ensure sandbox communication passes through a guard, combines it with post-handshake attestation bound to standard TLS 1.3 channel bindings, mints short-lived channel-bound scope tokens, and requires the destination guard to re-validate identity, scope, and binding before releasing plaintext. kTLS supplies the efficient protected dataplane. The result is transparent, auditable, scope-bound communication that requires no changes to user-layer orchestration code.

What carries the argument

eBPF-enforced traffic interception combined with post-handshake attestation bound to TLS 1.3 channel bindings, which routes all traffic through the guard and enforces policy via minted scope tokens.

If this is right

Agent-to-agent messages receive consistent least-privilege authorization through short-lived channel-bound scope tokens.
Security policies move from scattered application code to a single infrastructure-level guard.
Kernel-level interception creates auditable records of identity, scope, and delegation.
Communication works across heterogeneous clouds using only standard Linux primitives.
No modification to user orchestration code is needed for the security layer to apply.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same interception-plus-binding pattern could be tested on other kernel primitives if eBPF equivalents exist elsewhere.
Performance measurements under high agent interaction rates would clarify whether kTLS keeps overhead acceptable.
Integration with existing container runtimes might require only configuration changes rather than code patches.

Load-bearing premise

eBPF can be set up to catch every sandbox communication path and the attestation binding to TLS 1.3 channel bindings cannot be bypassed or forged.

What would settle it

A working demonstration that an agent communicates successfully without triggering the eBPF guard or without a valid attested channel binding would disprove the enforcement claim.

Figures

Figures reproduced from arXiv: 2605.27488 by Biao Gao, David Levitsky, Gan Fang, Qiancheng Wu, Rob Cameron, Shawna Murphy Butterworth, Sheng Mao, Wenhui Zhang.

**Figure 1.** Figure 1: Grimlock deployment. Each host runs a per-agent sandbox Confidential VM (CVM) and a per-host proxy CVM. eBPF enforces no-bypass mediation and steers traffic through the proxy. Proxies communicate via the Grimlock A2A Protocol over TLS 1.3 (kTLS-assisted datapath). 2 Design of Grimlock Grimlock provides substrate-level security for high-agency agents by enforcing a no-bypass network mediation point at the … view at source ↗

read the original abstract

Agentic systems increasingly run user-authored orchestration code that invokes tools, spawns subtasks, and delegates work across machines and clouds. Although this high agency is productive, it creates a security problem: identity, authorization, provenance, and delegation are often pushed into application code, where they become difficult to enforce consistently and difficult to audit. We present Grimlock, an Agent Guard that restores separation of concerns by moving trust enforcement into the sandbox substrate while leaving agent code unchanged. Grimlock uses eBPF-enforced traffic interception to ensure that sandbox communication passes through a guard, and combines it with post-handshake attestation bound to standard TLS~1.3 channel bindings. After a channel is established, the guard authorizes communication and mints short-lived, channel-bound scope tokens that capture least-privilege delegation. At the receiving side, the destination guard re-validates identity, scope, and channel binding, terminates TLS, and releases plaintext to the destination sandbox only after policy checks succeed. kTLS provides an efficient dataplane for protected communication. As a result, Grimlock offers a path toward transparent, auditable, and scope-bound agent-to-agent communication across heterogeneous multi-cloud environments, using commodity Linux primitives and without requiring changes to user-layer orchestration code.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Grimlock sketches an eBPF-plus-TLS guard for agent delegation but the security claims rest on unproven assumptions about interception coverage and channel binding.

read the letter

The paper's main point is that agentic systems need enforcement moved out of user code and into the sandbox layer, and Grimlock tries to do that with eBPF traffic interception plus post-handshake attestation tied to TLS 1.3 channel bindings. The result is supposed to be transparent, scope-bound communication across clouds without touching the orchestration code.

What is actually new is the framing for high-agency, multi-cloud agent setups. Most prior work on eBPF or attested TLS focuses on general containers or services; applying the combination specifically to delegation and provenance in agent-to-agent flows is a reasonable extension even if the primitives themselves are established.

The architecture description is clear on the high-level flow: intercept, attest, mint short-lived tokens, re-validate at the receiver, and use kTLS for the data plane. That separation of concerns is a practical goal.

The soft spots are exactly where the stress-test note flags them. The abstract gives no attachment points for eBPF, no argument that every possible networking path in heterogeneous environments is covered, and no protocol detail on binding the attestation to the TLS exporter value so an attacker cannot swap identities on the same channel. Without a threat model, any measurements, or even a prototype sketch, those two conditions remain assumptions rather than demonstrated properties.

This is for people working on secure agent platforms who are already thinking about kernel-level controls. A reader looking for concrete mechanisms or evaluation data will come away empty. It deserves a serious referee if the authors add the missing details on coverage and binding; right now the evidence is too thin to judge whether the central claim holds.

Referee Report

2 major / 2 minor

Summary. The manuscript presents Grimlock, an Agent Guard for high-agency systems. It uses eBPF-enforced traffic interception to route all sandbox communication through a guard, combined with post-handshake attestation bound to TLS 1.3 channel bindings. After channel establishment the guard authorizes flows and mints short-lived channel-bound scope tokens for least-privilege delegation; the receiving guard re-validates identity, scope and binding before releasing plaintext. The design aims to deliver transparent, auditable, scope-bound agent-to-agent communication across heterogeneous multi-cloud environments using only commodity Linux primitives (eBPF, kTLS) and without changes to user-layer orchestration code.

Significance. If the interception and binding mechanisms can be shown to be reliable and forgery-resistant, Grimlock would supply a practical substrate-level enforcement layer for identity, authorization and provenance in agentic systems. The reliance on standard OS primitives rather than application changes is a clear strength for deployability across clouds.

major comments (2)

[Abstract] Abstract: the claim that eBPF-enforced interception ensures every sandbox-to-sandbox flow passes through the guard supplies no attachment points (cgroup, tc, sockmap, etc.) and no argument that all user-space or container networking paths are covered. This property is load-bearing for the asserted transparency and unavoidability of the guard.
[Abstract] Abstract: the post-handshake attestation is said to be 'bound to standard TLS 1.3 channel bindings' but no protocol sketch or cryptographic argument is given showing how the attestation is tied to the TLS exporter or tls-unique value so that an active attacker cannot present a different attested identity on the same channel. This is load-bearing for the forgery resistance of the attested channels and minted scope tokens.

minor comments (2)

The abstract is concise but would benefit from a single high-level architecture diagram illustrating the interception, handshake, attestation and token-minting steps.
Key terms such as 'scope tokens' and 'channel-bound' appear without prior definition; a short glossary or inline clarification on first use would improve readability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments identifying areas where the abstract could more explicitly support its claims. We address each point below and will revise the manuscript accordingly to improve clarity on the interception and attestation mechanisms.

read point-by-point responses

Referee: [Abstract] Abstract: the claim that eBPF-enforced interception ensures every sandbox-to-sandbox flow passes through the guard supplies no attachment points (cgroup, tc, sockmap, etc.) and no argument that all user-space or container networking paths are covered. This property is load-bearing for the asserted transparency and unavoidability of the guard.

Authors: We agree the abstract would be strengthened by naming the attachment points and sketching the coverage argument. In the revision we will update the abstract to reference the eBPF programs (cgroup v2 for container isolation, tc for egress control, and sockmap for socket-level redirection) and note that these are applied at the host and container runtime layers to intercept all user-space and container networking paths. A supporting paragraph will be added to Section 4 explaining why no bypass paths remain under standard Linux container configurations. revision: yes
Referee: [Abstract] Abstract: the post-handshake attestation is said to be 'bound to standard TLS 1.3 channel bindings' but no protocol sketch or cryptographic argument is given showing how the attestation is tied to the TLS exporter or tls-unique value so that an active attacker cannot present a different attested identity on the same channel. This is load-bearing for the forgery resistance of the attested channels and minted scope tokens.

Authors: We accept that the abstract lacks an explicit sketch of the binding. The manuscript body (Section 5) already uses the TLS 1.3 exporter value per RFC 8446 to bind the attestation, but we will revise the abstract to include a one-sentence description of this binding and will ensure the main text contains a concise cryptographic argument that an active attacker substituting a different attested identity would fail the channel-binding check at the receiving guard before any scope token is accepted. revision: yes

Circularity Check

0 steps flagged

No circularity: purely architectural description with no derivation chain

full rationale

The paper describes a system design using eBPF interception, kTLS, and TLS 1.3 channel bindings for agent communication guards. It contains no equations, fitted parameters, predictions, or quantitative derivations. All load-bearing claims are feasibility statements about commodity Linux primitives rather than results that reduce to their own inputs by construction. No self-citations, ansatzes, or uniqueness theorems are invoked in a manner that creates circularity. This is a standard non-finding for an architectural security paper.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract provides no explicit free parameters, axioms, or invented entities; the design implicitly assumes reliable eBPF hooking and secure TLS channel binding.

pith-pipeline@v0.9.1-grok · 5774 in / 1008 out tokens · 30892 ms · 2026-06-29T17:21:00.049389+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

10 extracted references · 1 canonical work pages · 1 internal anchor

[1]

Norm Hardy. 1988. The Confused Deputy: (or why capabilities might have been invented).ACM SIGOPS Operating Systems Review22, 4 (1988), 36–38

1988
[2]

Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, et al . 2024. MetaGPT: Meta programming for a multi- agent collaborative framework. International Conference on Learning Representations, ICLR

2024
[3]

Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, et al. 2023. Agentbench: Evaluating llms as agents.arXiv preprint arXiv:2308.03688(2023)

work page internal anchor Pith review Pith/arXiv arXiv 2023
[4]

Sandhu and Pierangela Samarati

Ravi S. Sandhu and Pierangela Samarati. 1994. Access Control: Princi- ples and Practice.IEEE Communications Magazine32 (1994), 40–48

1994
[5]

Muhammad Usama Sardar. 2026. Pre-, Intra- and Post-handshake Attestation. Internet-Draft, IETF SEAT WG. Work in Progress: draft- usama-seat-intra-vs-post-02

2026
[6]

Nick Sullivan. 2022. Exported Authenticators in TLS. RFC 9261. doi:10. 17487/RFC9261

2022
[7]

Yanlin Wang, Wanjun Zhong, Yanxian Huang, Ensheng Shi, Min Yang, Jiachi Chen, Hui Li, Yuchi Ma, Qianxiang Wang, and Zibin Zheng
[8]

Automated Software Engineering32, 2 (2025), 1–36

Agents in software engineering: Survey, landscape, and vision. Automated Software Engineering32, 2 (2025), 1–36

2025
[9]

Samuel Whited. 2022. Channel Bindings for TLS 1.3. RFC 9266. doi:10. 17487/RFC9266

2022
[10]

Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, et al . 2024. Autogen: Enabling next-gen LLM applications via multi-agent conver- sations. InFirst Conference on Language Modeling

2024

[1] [1]

Norm Hardy. 1988. The Confused Deputy: (or why capabilities might have been invented).ACM SIGOPS Operating Systems Review22, 4 (1988), 36–38

1988

[2] [2]

Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, et al . 2024. MetaGPT: Meta programming for a multi- agent collaborative framework. International Conference on Learning Representations, ICLR

2024

[3] [3]

Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, et al. 2023. Agentbench: Evaluating llms as agents.arXiv preprint arXiv:2308.03688(2023)

work page internal anchor Pith review Pith/arXiv arXiv 2023

[4] [4]

Sandhu and Pierangela Samarati

Ravi S. Sandhu and Pierangela Samarati. 1994. Access Control: Princi- ples and Practice.IEEE Communications Magazine32 (1994), 40–48

1994

[5] [5]

Muhammad Usama Sardar. 2026. Pre-, Intra- and Post-handshake Attestation. Internet-Draft, IETF SEAT WG. Work in Progress: draft- usama-seat-intra-vs-post-02

2026

[6] [6]

Nick Sullivan. 2022. Exported Authenticators in TLS. RFC 9261. doi:10. 17487/RFC9261

2022

[7] [7]

Yanlin Wang, Wanjun Zhong, Yanxian Huang, Ensheng Shi, Min Yang, Jiachi Chen, Hui Li, Yuchi Ma, Qianxiang Wang, and Zibin Zheng

[8] [8]

Automated Software Engineering32, 2 (2025), 1–36

Agents in software engineering: Survey, landscape, and vision. Automated Software Engineering32, 2 (2025), 1–36

2025

[9] [9]

Samuel Whited. 2022. Channel Bindings for TLS 1.3. RFC 9266. doi:10. 17487/RFC9266

2022

[10] [10]

Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, et al . 2024. Autogen: Enabling next-gen LLM applications via multi-agent conver- sations. InFirst Conference on Language Modeling

2024