We just published the technical specification (v0.1.1) for the APDI/SEP security architecture for agentic systems.
Recent attacks (like ZombieAgent) demonstrate that current agent implementations give LLMs direct access to syscalls and the network. Since LLMs are inherently susceptible to indirect prompt injection, parsing poisoned web content can lead to zero-click exfiltration or worm-like infection.
We propose a protocol that eliminates "in-band" command execution. Instead of direct function calling, the agent formulates a canonical intent object (JSON) that passes through a strict 4-layer perimeter:
Execution Service (ephemeral sandboxes via Linux namespaces/Firecracker, seccomp, proxy-mediation).
Response Validation (AST sanitization to prevent tool reflection).
A key feature is "Separation of Powers". We decouple cognitive control (protected by KDA cryptographic directives) from execution policies. The document includes a detailed Attack Surface Priority Map, where we honestly acknowledge the Semantic Airlock as the most vulnerable probabilistic node in the chain.
1 comment
[ 1.6 ms ] story [ 11.9 ms ] threadRecent attacks (like ZombieAgent) demonstrate that current agent implementations give LLMs direct access to syscalls and the network. Since LLMs are inherently susceptible to indirect prompt injection, parsing poisoned web content can lead to zero-click exfiltration or worm-like infection.
We propose a protocol that eliminates "in-band" command execution. Instead of direct function calling, the agent formulates a canonical intent object (JSON) that passes through a strict 4-layer perimeter:
Semantic Airlock (deterministic intent parsing/normalization).
Validation Layer (RBAC-like declarative Capabilities).
Execution Service (ephemeral sandboxes via Linux namespaces/Firecracker, seccomp, proxy-mediation).
Response Validation (AST sanitization to prevent tool reflection).
A key feature is "Separation of Powers". We decouple cognitive control (protected by KDA cryptographic directives) from execution policies. The document includes a detailed Attack Surface Priority Map, where we honestly acknowledge the Semantic Airlock as the most vulnerable probabilistic node in the chain.
We'd love technical feedback and critique: https://singularityforge.space/2026/02/15/apdi-sep-security-...