Kairos holds uncertain agent actions for later review

When an agent acts on content that may contain an attack, the first action can resemble legitimate work, while later actions reveal its consequences. Can a monitor wait for that evidence without either releasing harmful effects or blocking useful tasks?

Kairos stages uncertain file changes and holds requests whose replies are not needed while the agent continues, so later actions can inform the decision. A request whose reply the agent needs must be decided before sending.

Kairos holds uncertain effects at the isolation boundary. Its policy applies rules and checks trusted provenance and data clearance; a bounded oracle reviews deferred effects against the task and action trace.

On AgentDojo, which tests attacks hidden in content an agent reads, can a defense reduce successful attacks without sharply lowering ordinary task completion? Attack success counts injection cases where the attacker’s goal is completed; benign utility counts user tasks completed without an attack.

The authors compared GPT-4.1 with Kairos against the undefended agent across four suites. Attack success fell from 47.0% to 2.7% of injection cases, while benign utility was 85.1% versus 82.7% of benign tasks.

This supports a bounded conclusion that Kairos reduced attacks while keeping ordinary task completion near the undefended level in this test.

These results cover benchmark simulations, where tool calls were adapted into boundary events rather than actual system effects. Authorization also depends on policy rules and an oracle that can be persuaded by untrusted content; Kairos does not guarantee that every release is correct.