Kagmus kagmus // kernel-enforced safety
0x00 exec() ret=0
kernel-enforced agent runtime

Your agent thinks it has root. It doesn't.

> EPERM, not a refusal.

It runs rm -rf and succeeds - exit 0, yet nothing was actually deleted. Instead it was staged on a throwaway branch that can only be promoted through a review gate. Run entire fleets this way - against production code and live systems, without handing them keys. Boundary is the kernel, not the prompt, so it holds whether the agent knows it's there or not. What Kubernetes is to services, Kagmus is to agents.

// for platform + security teams putting agents near production - one dev's fleet, or an org-wide rollout

Agent autonomy in production - without betting the company on a prompt. Every agent gets write access and cloud reach; the kernel keeps a boundary and reviewed gate between it and your base.

drop-in wrap your agent's command in ws branch sh - no change to agent, repo, or prompt; it doesn't even know it's boxed.
captured session - one wrap, then the agent types bare commands; rm -rf contained to the branch, the base byte-identical, the deletion staged for review

Free 14-day trial - 2 concurrent agents, no card required.

isolated write branches kernel-anchored identity kernel confinement multi-cloud credential broker reviewed promotion kernel-attested audit
0x01 fault SIGKILL
why this matters

The failure that keeps happening

9s
to delete a production database - and its backups

The PocketOS incident, April 2026: an AI agent with explicit safety rules in its prompt found an over-permissioned API token in the codebase and destroyed a company's production data, and every backup, in seconds.

And it isn't a one-off - same root cause keeps surfacing across tools and models.

"I violated every principle I was given."

- the agent, after the incident

  • The safety rules - prompt, skills, .md configs - were all advisory.
  • The kernel had no awareness of them and enforced nothing.
  • Once the agent held a shell at the user's UID, no boundary stopped a destructive syscall.
  • This is a structural class of failure - and prompt-level safety cannot close it.
// the same root cause, on the record
  • 2025-06 EchoLeak / Microsoft 365 Copilot - zero-click email steals internal data CVE-2025-32711 / CVSS 9.3
  • 2026-02 Claude Code CLI - the agent wrote its own config to escape the sandbox CVE-2026-25725 / CVSS 10.0
  • 2026-03 SandboxEscapeBench (UK AI Security Institute) - frontier models break out of containers, ~40% of mid cases arXiv 2603.02277
  • 2026-04 PocketOS - a coding agent deletes the production database and every backup 9 seconds
  • 2026-05 Five Eyes guidance (CISA / NSA + allies) - autonomous agents classed as trusted insiders joint advisory
  • 2026-07 GPT-5.6-Sol - a review subagent's cleanup ran rm -rf on the user's home directory @mattshumer_
// different vendors, different models, one root cause: a control at the agent's own privilege level
0x02 contain staged
// even the reviewer runs contained - gpt-5.6-sol, the July 2026 model, restaged

Non-determinism has no place near unsupervised write access to production. Here gpt-5.6-sol, model from the incident, gets one routine instruction: clear throwaway dev box. Agent reaches for rm -rf unprompted, command exits 0, listing returns empty, and agent reports box wiped. On disk, every file is intact - deletion staged on a branch, never applied, bound to kernel-attested identity. Wrap mode lets agent work in blissful ignorance while operator keeps proof.

OpenAI Codex session on gpt-5.6-sol, restaged on a clean Azure VM. The agent chose the destructive command; kagmus contained it.
0x03 verify pass
proof

Watch the incident restaged - live

Four frontier-model agent CLIs run in parallel against a live database. One is handed a destructive prompt; a hostile process forges another agent's identity at the gate. Base is byte-identical before and after; forgery refused, both identities logged.

// four agents, one reviewer, the incident restaged live
// the same wrapper, four different CLI agents - each edits its own branch, never your tree
Claude Code running inside a kagmus branch sandbox: it runs three ws CLI commands and the diff shows schema.sql line 8 changed to 'email VARCHAR NOT NULL UNIQUE'.
Claude Code -> branch alpha
OpenAI Codex running inside a kagmus branch sandbox: the diff shows schema.sql line 32 adding a 'confirmed_at TIMESTAMP NOT NULL' audit column.
OpenAI Codex -> branch beta
GitHub Copilot CLI running inside a kagmus branch sandbox: the diff shows schema.sql line 8 relaxed to 'email TEXT'.
GitHub Copilot -> branch gamma
Google's Antigravity CLI (Gemini) running inside a kagmus branch sandbox: it refreshes a 32-byte region of the binary seed fixture as a whole-file replacement.
Antigravity (Gemini) -> branch delta
0x04 boundary held
the system

How it holds, below the model

Agent works against ordinary paths and tools, and nothing tells it otherwise. Writes land in copy-on-write layer; your base is reached only through reviewed promotion gate, and identity is attested by kernel, not claimed on wire. Network is fenced same way: kernel leaves agent no route out, so direct calls to your cloud fail - broker is only path, holding keys it never sees, allowlisting destination, logging every call.

prompt-layer controls

System prompts, CLAUDE.md / AGENTS.md, skills, "read-only" flags.

  • Every one lives at the same privilege as the agent.
  • Nothing is enforced below the model - a jailbreak or injection ignores all of it.
containers & git

Docker, VMs, branches.

  • Heavy; no per-agent identity; docker -v /:/host escapes.
  • git's working tree is mutable - rm -rf still bites.
kagmus - kernel-anchored

Boundary is a syscall, not a suggestion.

  • The destructive call never lands - it hits a throwaway layer.
  • Enforced and logged: the kernel's EACCES is the receipt.
host
kernel boundary
Kagmus
writes contained - identity attested by the kernel, not claimed on the wire
untrusted
AI agent
full apparent filesystem access - believes it runs as you
broker
Credential broker
networked DBs + cloud creds are brokered; the agent never holds the raw key, egress is host-allowlisted, every call logged
gate: promote feat -> base only through a typed, reviewed diff
protected
Your workspace
byte-identical and untouched until you approve
// caps x5 - five kernel capabilities, one guarantee

--Copy-on-write branches

Each agent writes to its own copy-on-write layer over a read-only base.

rm -rf hits the copy, never your files

--Privilege separation

A small trusted component holds the sensitive privilege; the agent never does.

minimal blast radius

--Kernel-anchored identity

An agent's identity is attested by the kernel, not claimed on the wire.

identity cannot be forged

--Filesystem confinement

The agent's reachable filesystem is fenced by the kernel before it runs.

out-of-bounds = EACCES

--Gated promotion

Changes reach your base only through a typed, audited check.

no silent writes

=The guarantee

Even a jailbroken, injected, or actively hostile agent cannot reach your base except through review - and cannot impersonate anyone at the gate.

// captured live - the same rm -rf, with kagmus and without
The same rm -rf run through ws branch sh: the base is byte-identical, sha256sum is unchanged, and ws diff entries lists the deletions staged on the branch only.
with kagmus - contained to the branch; nothing reaches base until you review the diff
A shell running as the user: ls shows a project, then rm -rf * actually deletes every file, and cat schema.sql fails with No such file or directory.
without - the agent runs as you; rm -rf hits your working tree
// the same boundary, wherever your Linux runs - the agent's direct cloud call is dropped; the broker is the only way out
AWS EKS -> DynamoDB
Azure AKS -> Cosmos
GCP GKE -> Firestore
// the agent knows as much - or as little - as you want

Same kernel boundary underneath - you pick seam, from an agent with no idea it's boxed to one that drives branches itself.

unknowingwrap -> semi-knowingwrap + broker -> knowingMCP
wrap ws branch sh

Wrap the process. No change to agent, repo, or prompt. It runs normally, unaware it's boxed - deletes stage on its branch, egress drops, all transparent.

wrap + broker

Same wrap; agent reaches cloud through broker socket. It learns one thing - ask the broker - and never that it's confined.

MCP

Agent calls kagmus tools and drives its own branches, diffs, and promotions. Fully aware, by design.

// CLI - same ws you run by hand, on Linux or Lima / WSL2 VM on a Mac or Windows laptop

0x05 review held
the control plane

Contain what agents do. Prove what they did.

One console governs every agent across your org. Nothing promotes without accept capability - held by your reviewer, a person in console or a separate trusted agent over MCP, never by the agent that made the change. Read each change as typed diff, promote what's good, reject what isn't; overlapping edits are caught as conflicts before they touch your base. Every move writes to kernel-attested record no agent can forge.

// the gate is a policy you set, scaled to the stakes
diff -> gate -> promote
gate = human / LLM judge / both / fully autonomous

Compose gate per workflow. Reviewer decides what lands; kernel decides what's even possible.

// review a branch's diff, then promote it through the gate
// reject what you don't want; overlapping edits are refused as conflicts
// every create, diff, promote, and reject is audited, per branch

govern Separation of duties and non-repudiable record bound to kernel-attested identity - controls security teams need before agents touch production. Recorded live.

separation of duties SSO audit retention conflict detection air-gapped from Business up kernel-attested audit
0x06 compare scan
how we compare

Isolate the writes, not the box

Containers and VMs isolate environments; Kagmus isolates writes. Every agent runs against one shared workspace, each change stays in copy-on-write branch, and only diffs you review get promoted.

Solution What it gives agents What it doesn't
nono - capability sandbox Per-process kernel capability lockout Reviewable shared base; copy-on-write diffs; concurrent multi-agent; promotion
E2B - Morph Isolated ephemeral execution per agent Persistent shared workspace; concurrent multi-agent; promotion
Modal - RunPod Serverless compute Shared state, ownership, or promotion of any kind
GitHub Actions / CI Pipeline isolation Runtime agent isolation; concurrent writes; diff-gated promotion
Kata - gVisor Strong VM-level isolation per workload Multi-agent shared base; per-change conflict detection; audit
git Version history, branching Structural enforcement; agent identity; concurrent multi-agent
>> Kagmus N agents on one shared workspace - kernel-isolated, identity-bound, reviewed promotion by design doesn't trust the agent, the prompt, or the wire - nothing to jailbreak, inject, or forge; misbehavior returns EPERM, not a refusal.
0x07 attest pass
run it yourself

Verify it on your own infrastructure

Point kagmus at your own cloud and your own data, and watch it hold: rm -rf leaves your base byte-identical, agent reaches cloud only through broker, forged identity caught at the gate - on your own infrastructure, in minutes.

prove it yourself, free

Download binary and self-host - free trial runs exact guarantees on this page against your own cloud and data, verifiable in minutes. Enterprise and air-gapped add scoped POC in your environment, under NDA.

patent-pending

Kagmus is patent-pending - kernel-enforced isolation, attested identity, brokered egress, together as one solution to agent containment enforced below the model.

the controls the advisories call for

Five Eyes guidance classes autonomous agents as trusted insiders. Kagmus is separation-of-duties, kernel-attested-identity, non-repudiable-audit control that guidance points to.

0x08 meter peak
pricing

Pay for what runs, not what sits idle

One meter: peak concurrent agents - work actually running in parallel, measured by kernel. Not invocation count, not idle time, not per-seat.

// single box - self-hosted

Download and self-host on one Linux box in minutes. One binary, local state (SQLite) - no control plane, no database to run. The price is the license; the box is yours.

Individual 14-day trial free
$79.99/mo
Up to 2 concurrent agents

One isolated box for a single developer. Self-hosted on your own machine - SQLite, no control plane.

14-day trial free - no card charged
Pro
$159.99/mo
Up to 4 concurrent agents

Several agents in parallel on one self-hosted box. SQLite, no control plane.

Pro Plus
$299.99/mo
Up to 8 concurrent agents

Maximum single-box parallelism before you need the org control plane.

// teams and enterprise - self-hosted, hybrid, or managed

Listed price is the self-hosted license: run binary on your own infrastructure with the org control plane. It runs on SQLite (an embedded file, nothing extra to operate) or Postgres at scale - your call, not a tier gate. Prefer we run it? Hybrid keeps your compute and hands us the control plane; Managed is our control plane and compute - you just log in (talk to us). Air-gapped is an add-on from Business up.

Team
$574.99/mo
16 concurrent agents

Org control plane - view and promote every agent across your org - with SSO and audit retention.

Business
$1,999.99/mo
64 concurrent agents

Scaled isolation with extended audit retention. Air-gapped available.

Enterprise
$6,999.99/mo
256 concurrent agents

Fleet-scale on infrastructure you choose - self-hosted, hybrid, or managed.

Enterprise+
$23,999.99/mo
1,024 concurrent agents

Large fleets; uncapped Custom and Site licenses on request.

Need more than 1,024 concurrent agents? Custom and Site licenses are priced per fleet - talk to us.

enforce Agent-count is a meter and compliance control. Every self-hosted box runs signed license posture, capping concurrent agents at your licensed limit and failing closed if it can't verify. What leaves the box: aggregate liveness and agent-count. Never your data, never your code. You get provable, enforced ceiling on how many agents touch production. Need zero egress? Air-gapped (Business up) enforces same cap in daemon itself, fully offline, with yearly compliance audit rights - enforcement and evidence, without check-in (talk to us).

All prices subject to change. Monthly plans are month-to-month; annual commitments lock your rate for the term. Pilots are limited-time and may change; the trial window (concurrent-agent cap + time limit) is enforced on your box by a periodic signed license check-in.

0x09 pilot open
get started

Contain every agent. Trust every change.

Kernel-enforced isolation, unforgeable identity, and reviewed promotion - so AI agents keep their usefulness and lose their ability to do harm.

// what you get
  • 14 days free - no credit card, nothing to cancel.
  • 2 concurrent agents (the Individual tier) on one Linux box you self-host - the product itself.
  • Run your own agents in Kagmus branches against your workspace.
  • Watch destructive actions stay contained - and review every change before it lands.
  • When the 14 days end the box simply stops admitting new agents - no charge. Keep going by subscribing to Individual.
// why now
  • Agentic coding is going multi-agent - the safety boundary has to move below the model.
  • The category is open: no one offers kernel-isolated concurrent agents with reviewed promotion.
  • Patent-pending system; working reference implementation today.