AgentSafe: A Secure Micro-VM Platform for AI Agents

AgentSafe is a sophisticated sandbox execution environment meticulously crafted for AI agents and code generation tools. By employing micro-VMs that provide per-request isolation, AgentSafe allows untrusted code to operate securely and efficiently, safeguarding your infrastructure from potential risks associated with executing arbitrary code.

Key Features of AgentSafe

AgentSafe addresses the limitations of traditional containers and virtual machines, offering:

• Enhanced Security: Utilizes hardware virtualization to provide distinct kernels for each workload, thereby fortifying security.
• Fast Performance: Achieves impressive boot times under 200 milliseconds while maintaining minimal memory usage.
• Robust Control: Implements fine-grained capability policies with a default-deny approach, ensuring that only explicitly permitted actions are executed.
• Comprehensive Observability: Delivers complete audit trails and performance metrics for regulatory compliance and operational insights.

Core Components

The initial version of AgentSafe includes several integral components designed to work seamlessly together:

• QEMU Runtime: Efficient execution of KVM-based micro-VMs managed through QMP.
• Policy Engine: YAML-driven capability policies that are validated before being enforced.
• CLI Tool: The agent-run command facilitates the execution of agents while adhering to defined policies.
• Go SDK: A programmatic API that enables integration into broader applications.
• Metrics Dashboard: Integration with Prometheus for monitoring the performance of virtual machines.
• VM Configuration Management: Declarative specifications for resource allocation including CPU, memory, and storage.

Future Enhancements

Upcoming Beta Release Features

• Firecracker Integration: Introducing a production-grade micro-VM runtime paired with a jailer for enhanced isolation.
• VM Supervisor: Support for request handling, pooling, and scale-to-zero capabilities.
• Image Builder: Tools to create minimal root file systems with support for metadata and signing.
• Secrets Service: Mechanism to safely inject metadata using vsock.
• Deployment Tools: Provisioning tools including Terraform modules and Kubernetes DaemonSets for streamlined deployment.

Production Features

• Advanced Network Control: Utilizes eBPF for refined egress traffic filtering and DNS interception.
• Security Hardening: Implements advanced seccomp profiles and isolation techniques to fortify execution environments.
• Evidence Bundles: Generates cryptographically signed audit trails to enhance accountability.
• Performance Optimization: Features warm pools and copy-on-write snapshots to enhance execution efficiency.
• Rigorous Testing: Comprehensive integration and performance testing suites to ensure reliability.

Basic Examples of Usage

Policy Creation

Creating a simple policy can be done easily using YAML:

metadata:  
  name: "development-policy"  
  version: "1.0"  
resources:  
  cpu_limit: 1  
  memory_limit: "512Mi"  
  timeout: "5m"  
network:  
  allow_egress: true  
  allowed_domains:  
    - "httpbin.org"  
    - "api.github.com"  
filesystem:  
  writable_paths:  
    - "/tmp"  

Execution of Agents

Agents can be executed using the CLI with defined policies:

# Run a simple command  
./bin/agent-run --policy examples/policies/development.yaml \
  --cmd "curl -s https://httpbin.org/json"  

Metrics Monitoring

AgentSafe supports metrics monitoring with Prometheus:

# Start the metrics demo  
cd examples/metrics-demo  
go run main.go  
# Access Grafana at http://localhost:3000  

Security Focus

AgentSafe is built on a foundation of security-first principles, ensuring that each execution occurs in a separate micro-VM with its own kernel. The platform employs default-deny policies which necessitate explicit capability grants before allowing operations. All executions are audit-enabled with cryptographic signatures, ensuring robust accountability and preventing abuse.

For further inquiries regarding security matters, please reach out to sarthakdeshwal@duck.com.