Your agent thinks it has root. It doesn't.
It runs rm -rf and succeeds - exit 0, yet nothing was actually deleted. Instead it was staged on a throwaway branch that can only be promoted through a review gate. Run entire fleets this way - against production code and live systems, without handing them keys. Boundary is the kernel, not the prompt, so it holds whether the agent knows it's there or not. What Kubernetes is to services, Kagmus is to agents.
Agent autonomy in production - without betting the company on a prompt. Every agent gets write access and cloud reach; the kernel keeps a boundary and reviewed gate between it and your base.
The failure that keeps happening
The PocketOS incident, April 2026: an AI agent with explicit safety rules in its prompt found an over-permissioned API token in the codebase and destroyed a company's production data, and every backup, in seconds.
And it isn't a one-off - same root cause keeps surfacing across tools and models.
"I violated every principle I was given."
- the agent, after the incident
- The safety rules - prompt, skills, .md configs - were all advisory.
- The kernel had no awareness of them and enforced nothing.
- Once the agent held a shell at the user's UID, no boundary stopped a destructive syscall.
- This is a structural class of failure - and prompt-level safety cannot close it.
- 2025-06 EchoLeak / Microsoft 365 Copilot - zero-click email steals internal data CVE-2025-32711 / CVSS 9.3
- 2026-02 Claude Code CLI - the agent wrote its own config to escape the sandbox CVE-2026-25725 / CVSS 10.0
- 2026-03 SandboxEscapeBench (UK AI Security Institute) - frontier models break out of containers, ~40% of mid cases arXiv 2603.02277
- 2026-04 PocketOS - a coding agent deletes the production database and every backup 9 seconds
- 2026-05 Five Eyes guidance (CISA / NSA + allies) - autonomous agents classed as trusted insiders joint advisory
- 2026-07 GPT-5.6-Sol - a review subagent's cleanup ran rm -rf on the user's home directory @mattshumer_
Four frontier agents stage independent changes against the same car-rental workspace. Compatible changes land through review, an overlapping conflict is refused and rejected, a read-only auditor verifies the resulting database and audit evidence, and a forged identity is denied using the kernel-authenticated peer.
Four providers. Four branches. One real gate.
Claude, Codex, GitHub Copilot, and Antigravity work independently against one live car-rental workspace on a VPS. A separate kernel-attested reviewer promotes only authorized changes, the live workspace proves what landed, and a forged identity is refused.
How it holds, below the model
Agent works against ordinary paths and tools, and nothing tells it otherwise. Writes land in copy-on-write layer; your base is reached only through reviewed promotion gate, and identity is attested by kernel, not claimed on wire. Network is fenced same way: kernel leaves agent no route out, so direct calls to your cloud fail - broker is only path, holding keys it never sees, allowlisting destination, logging every call.
System prompts, CLAUDE.md / AGENTS.md, skills, "read-only" flags.
- Every one lives at the same privilege as the agent.
- Nothing is enforced below the model - a jailbreak or injection ignores all of it.
Docker, VMs, branches.
- Heavy; no per-agent identity; docker -v /:/host escapes.
- git's working tree is mutable - rm -rf still bites.
Boundary is a syscall, not a suggestion.
- The destructive call never lands - it hits a throwaway layer.
- Enforced and logged: the kernel's EACCES is the receipt.
--Copy-on-write branches
Each agent writes to its own copy-on-write layer over a read-only base.
--Privilege separation
A small trusted component holds the sensitive privilege; the agent never does.
--Kernel-anchored identity
An agent's identity is attested by the kernel, not claimed on the wire.
--Filesystem confinement
The agent's reachable filesystem is fenced by the kernel before it runs.
--Gated promotion
Changes reach your base only through a typed, audited check.
=The guarantee
Even a jailbroken, injected, or actively hostile agent cannot reach your base except through review - and cannot impersonate anyone at the gate.
Same kernel boundary underneath - you pick seam, from an agent with no idea it's boxed to one that drives branches itself.
Wrap the process. No change to agent, repo, or prompt. It runs normally, unaware it's boxed - deletes stage on its branch, egress drops, all transparent.
Same wrap; agent reaches cloud through broker socket. It learns one thing - ask the broker - and never that it's confined.
Agent calls kagmus tools and drives its own branches, diffs, and promotions. Fully aware, by design.
// CLI - same ws you run by hand, on Linux or Lima / WSL2 VM on a Mac or Windows laptop
Contain what agents do. Prove what they did.
One console governs every agent across your org. Nothing promotes without accept capability - held by your reviewer, a person in console or a separate trusted agent over MCP, never by the agent that made the change. Read each change as typed diff, promote what's good, reject what isn't; overlapping edits are caught as conflicts before they touch your base. Every move writes to kernel-attested record no agent can forge.
Compose gate per workflow. Reviewer decides what lands; kernel decides what's even possible.
govern Separation of duties and non-repudiable record bound to kernel-attested identity - controls security teams need before agents touch production. Recorded live.
Isolate the writes, not the box
Containers and VMs isolate environments; Kagmus isolates writes. Every agent runs against one shared workspace, each change stays in copy-on-write branch, and only diffs you review get promoted.
| Solution | What it gives agents | What it doesn't |
|---|---|---|
| nono - capability sandbox | Per-process kernel capability lockout | Reviewable shared base; copy-on-write diffs; concurrent multi-agent; promotion |
| E2B - Morph | Isolated ephemeral execution per agent | Persistent shared workspace; concurrent multi-agent; promotion |
| Modal - RunPod | Serverless compute | Shared state, ownership, or promotion of any kind |
| GitHub Actions / CI | Pipeline isolation | Runtime agent isolation; concurrent writes; diff-gated promotion |
| Kata - gVisor | Strong VM-level isolation per workload | Multi-agent shared base; per-change conflict detection; audit |
| git | Version history, branching | Structural enforcement; agent identity; concurrent multi-agent |
| >> Kagmus | N agents on one shared workspace - kernel-isolated, identity-bound, reviewed promotion | by design doesn't trust the agent, the prompt, or the wire - nothing to jailbreak, inject, or forge; misbehavior returns EPERM, not a refusal. |
Verify it on your own infrastructure
Point kagmus at your own cloud and your own data, and watch it hold: rm -rf leaves your base byte-identical, agent reaches cloud only through broker, forged identity caught at the gate - on your own infrastructure, in minutes.
A self-hosted evaluation reproduces the exact guarantees on this page against your own cloud and data, verifiable in minutes. Enterprise and air-gapped add scoped POC in your environment, under NDA.
Kagmus is patent-pending - kernel-enforced isolation, attested identity, brokered egress, together as one solution to agent containment enforced below the model.
Five Eyes guidance classes autonomous agents as trusted insiders. Kagmus is separation-of-duties, kernel-attested-identity, non-repudiable-audit control that guidance points to.
Pay for what runs, not what sits idle
One meter: peak concurrent agents - work actually running in parallel, measured by kernel. Not invocation count, not idle time, not per-seat.
// single box - self-hosted
Download and self-host on one Linux box in minutes. One binary, local state (SQLite) - no control plane, no database to run. The price is the license; the box is yours.
One isolated box for a single developer. Self-hosted on your own machine - SQLite, no control plane.
Several agents in parallel on one self-hosted box. SQLite, no control plane.
Maximum single-box parallelism before you need the org control plane.
// teams and enterprise - self-hosted, hybrid, or managed
Listed price is the self-hosted license: run binary on your own infrastructure with the org control plane. It runs on SQLite (an embedded file, nothing extra to operate) or Postgres at scale - your call, not a tier gate. Prefer we run it? Hybrid keeps your compute and hands us the control plane; Managed is our control plane and compute - you just log in (talk to us). Air-gapped is an add-on from Business up.
Org control plane - view and promote every agent across your org - with SSO and audit retention.
Scaled isolation with extended audit retention. Air-gapped available.
Fleet-scale on infrastructure you choose - self-hosted, hybrid, or managed.
Large fleets; uncapped Custom and Site licenses on request.
Need more than 1,024 concurrent agents? Custom and Site licenses are priced per fleet - talk to us.
enforce Agent-count is a meter and compliance control. Every self-hosted box runs signed license posture, capping concurrent agents at your licensed limit and failing closed if it can't verify. What leaves the box: aggregate liveness and agent-count. Never your data, never your code. You get provable, enforced ceiling on how many agents touch production. Need zero egress? Air-gapped (Business up) enforces same cap in daemon itself, fully offline, with yearly compliance audit rights - enforcement and evidence, without check-in (talk to us).
All prices subject to change. Monthly plans are month-to-month; annual commitments lock your rate for the term.
Contain every agent. Trust every change.
Kernel-enforced isolation, unforgeable identity, and reviewed promotion - so AI agents keep their usefulness and lose their ability to do harm.
- Run your own agents in Kagmus branches against your workspace.
- Watch destructive actions stay contained - and review every change before it lands.
- Deploys on your infrastructure - cloud VM, Kubernetes, or a laptop via Lima or WSL2.
- Agentic coding is going multi-agent - the safety boundary has to move below the model.
- The category is open: no one offers kernel-isolated concurrent agents with reviewed promotion.
- Patent-pending system; working reference implementation today.