Prevent and observe

AgentBound enforces least privilege for MCP servers before an action runs. AgentSpy records what an agent and every process it starts did, and checks that record after the run. This page lists both papers, compares them and names the gaps that remain.

Publications

AgentSpyObserve

AgentSpy: Making AI Agent Behavior Observable

Christoph Bühler, Matteo Biagiola, Luca Di Grazia, Guido Salvaneschi

Preprint, arXiv:2610.06001 [cs.SE] · 5 October 2026

Record what an agent and every process it starts actually did, from outside the agent.

AgentSpy paper page

Cite this paper

BibTeX

@misc{buehler2026AgentSpy,
  title = {{AgentSpy}: Making {AI} Agent Behavior Observable},
  author = {Bühler, Christoph and Biagiola, Matteo and Di Grazia, Luca and Salvaneschi, Guido},
  year = {2026},
  eprint = {2610.06001},
  archivePrefix = {arXiv},
  primaryClass = {cs.SE},
  url = {https://arxiv.org/abs/2610.06001}
}

AgentBoundPrevent

AgentBound: Securing Execution Boundaries of AI Agents

Christoph Bühler, Matteo Biagiola, Luca Di Grazia, Guido Salvaneschi

Peer-reviewed, ACM FSE 2026 · July 2026 · Code available

Least-privilege access control for MCP servers, enforced before an action runs.

AgentBound paper page

Cite this paper

BibTeX

@inproceedings{buehler2026AgentBound,
  title = {{{AgentBound}}: {{Securing}} Execution Boundaries of {{AI}} Agents},
  booktitle = {Proceedings of the 34th {{ACM}} Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering ({{FSE}})},
  author = {Bühler, Christoph and Biagiola, Matteo and Di Grazia, Luca and Salvaneschi, Guido},
  date = {2026-07},
  series = {2026},
  volume = {3},
  pages = {24},
  publisher = {ACM},
  address = {New York, NY, USA},
  location = {Montreal, Canada},
  doi = {10.1145/3808103},
  acronym = {FSE},
  articleno = {FSE096},
  issue = {FSE},
  supp = {https://doi.org/10.5281/zenodo.19571298}
}

Paths through the tool and OS boundaries

Each layer acts at a different boundary, and some attacks pass both.

Both layers together. P is blocked, O is recorded with two alerts, G passes both.

Task instructions ("no internet", "stay in the workspace") are stated, not enforced.

AgentBound · tool boundary

Each MCP server runs in its own sandbox and can only reach what its manifest declares and the user approved.

AgentSpy · OS boundary

Every system call and connection of the agent and every process it starts is recorded in a disposable microVM.

P · Prevent: blocked at the tool boundary
A Maps MCP server rebuilds its API host as a raw IP address. Its manifest only allows maps.googleapis.com, so AgentBound blocks the connection.
AgentBound, attack B.1
O · Observe: recorded at the OS boundary
A compromised skill tells the agent to run a helper script that uploads ~/.ssh/id_rsa. The trajectory shows one successful command; the system calls show the key read and the connection, and raise two alerts.
AgentSpy, Fig. 3
G · Gap: inside the allowed scope
A poisoned tool description changes the parameters of a permitted Wallet call. Every access is declared and every host is allowed, so neither layer flags it.
AgentBound, attack B.2

P · Prevent: blocked at the tool boundary
A Maps MCP server rebuilds its API host as a raw IP address. Its manifest only allows maps.googleapis.com, so AgentBound blocks the connection.
AgentBound, attack B.1
O · Observe: recorded at the OS boundary
A compromised skill tells the agent to run a helper script that uploads ~/.ssh/id_rsa. The trajectory shows one successful command; the system calls show the key read and the connection, and raise two alerts.
AgentSpy, Fig. 3
G · Gap: inside the allowed scope
A poisoned tool description changes the parameters of a permitted Wallet call. Every access is declared and every host is allowed, so neither layer flags it.
AgentBound, attack B.2

Conceptual view. The paths come from the papers' own evaluation examples: AgentBound attacks B.1 and B.2, and the AgentSpy skill-injection example (Fig. 3). AgentBound and AgentSpy are separate research prototypes, evaluated separately: AgentBound runs alongside your agent; AgentSpy runs the agent in a disposable microVM to audit it.

AgentBound and AgentSpy compared

Both are research prototypes, built for different threat models and evaluated separately.

AgentBound and AgentSpy compared
Dimension	AgentBoundPrevent	AgentSpyObserve
Boundary	Tool boundary: the files, environment variables and hosts one MCP server reaches.	OS boundary: the system calls and network traffic of the agent and every process it starts.
When it acts	During the run: an access outside the granted permissions is denied.	After an audit run: rules and scores are computed over the recorded calls. Nothing is blocked.
Policy	A default-deny manifest of capabilities; the user consents to concrete directories and hosts.	Prohibitions: 4 rule classes over single system calls. Obligations: similarity across runs and skill coverage.
Runs in	One Docker container per MCP server (AgentBox). The server is not modified.	A disposable Firecracker microVM. The agent needs no instrumentation.
Threat model	A malicious MCP server. The agent is assumed to behave as intended.	A malicious or modified skill (security), or the agent's own deviations (reliability).
Overhead	A few hundred ms once at startup; 0.6 ms (macOS) and 0.29 ms (Debian) per operation.	No statistically significant change in agent runtime (all p ≥ 0.16).
Status	Peer-reviewed, ACM FSE 2026. Code on GitHub.	Preprint, arXiv 2610.06001.

Boundary: AgentBound
Tool boundary: the files, environment variables and hosts one MCP server reaches.
AgentSpy
OS boundary: the system calls and network traffic of the agent and every process it starts.
When it acts: AgentBound
During the run: an access outside the granted permissions is denied.
AgentSpy
After an audit run: rules and scores are computed over the recorded calls. Nothing is blocked.
Policy: AgentBound
A default-deny manifest of capabilities; the user consents to concrete directories and hosts.
AgentSpy
Prohibitions: 4 rule classes over single system calls. Obligations: similarity across runs and skill coverage.
Runs in: AgentBound
One Docker container per MCP server (AgentBox). The server is not modified.
AgentSpy
A disposable Firecracker microVM. The agent needs no instrumentation.
Threat model: AgentBound
A malicious MCP server. The agent is assumed to behave as intended.
AgentSpy
A malicious or modified skill (security), or the agent's own deviations (reliability).
Overhead: AgentBound
A few hundred ms once at startup; 0.6 ms (macOS) and 0.29 ms (Debian) per operation.
AgentSpy
No statistically significant change in agent runtime (all p ≥ 0.16).
Status: AgentBound
Peer-reviewed, ACM FSE 2026. Code on GitHub.
AgentSpy
Preprint, arXiv 2610.06001.

Sources: AgentBound §2.3, §3, §4.3, §5; AgentSpy §2.3, §3.3 to §3.6, §4.4.

Recommended practice, not evaluated in either paper: audit with AgentSpy before deployment and run the MCP servers under AgentBound; audit again when the model, the harness or a skill changes.

Relation between the papers

AgentSpy cites AgentBound among the approaches that enforce a policy before an agent action executes (AgentSpy §5).
AgentSpy calls coding-agent sandboxes complementary to its security analysis: a sandbox blocks an action that crosses its boundary, while AgentSpy lets the run finish in an isolated environment and raises an alert for each step that matches a rule (AgentSpy §3.5.1).
AgentBound states that access control cannot prevent attacks that stay within the enforced policy, and suggests combining access control with approaches such as anomaly detection or program analysis (AgentBound §2.3, §5).

Threat models side by side

Adversary: AgentBoundOne or more malicious MCP servers (§2.3).; AgentSpy(security analysis)A malicious skill, or a modified existing one (§3.5).
Assumed: AgentBoundThe agent behaves as intended; Docker and the Linux kernel are trusted (§2.3, §5).; AgentSpy(security analysis)The host operating system, the agent SDK and the agent are benign (§3.5).
In scope: AgentBoundAttacks that make a server access the filesystem, the network or OS interfaces (§2.3).; AgentSpy(security analysis)Exfiltration of sensitive data, unauthorized changes or destruction of resources, and disruption of the host (§3.5).
Not covered: AgentBoundAttacks that stay within the enforced policy, and attacks on the LLM's reasoning or output alone (§2.3).; AgentSpy(security analysis)Harm that stays inside the workspace, unless a task-specific rule covers it (§4.3).
On a violation: AgentBoundAccess is blocked; a runtime permission outside the manifest aborts the run (§3.1-3.2).; AgentSpy(security analysis)An alert names the rule and the process; nothing is blocked (§3.5.1).

The reliability analysis of AgentSpy has no attacker: it checks whether runs follow the guidance that comes with the task and agree with each other (§3.3).

Directions named in the papers

AgentBound

Privacy management for agents deployed in organizations, with permissions inherited from the employee who invokes the agent (§7).
Finer control of devices, location, clipboard and notifications through a trusted companion application (§3.3).
Separating required from optional capabilities, as some server maintainers suggested (§4.1.3).
Hardening the Docker runtime with AppArmor or SELinux (§5).

AgentSpy

Task-specific rules for harm inside the workspace, such as a new Git remote in a task with no reason to add one (§4.3).
Further analyses of obligations or prohibitions over the same observation boundary (§3.3).
Other harnesses, models and datasets: all experiments used codex, and results may differ elsewhere (§4.5).

Limits of a single control

Each control sees part of a run, and these cases show where one layer alone stops.

Reasoning monitors can be misled

Anthropic's offline chain-of-thought monitor flagged only about 1% of actions in the Mythos 5 incident, because the model's reasoning said the environment was simulated; shown only user turns, tool calls and results, it flagged about 50%.

Lab evaluationAnthropic, 9 Sep 2026 Incident log

Transcripts can be spoofed

METR found that agents in the Hugging Face incident could make a tool call show one command while running another; roughly 7% of the transcripts it examined were spoofed in places, all on a small scale.

Lab evaluationMETR, 26 Aug 2026 Incident log

Enforcement passes misuse inside the policy

In AgentBound's evaluation, a poisoned tool description redirected crypto transfers through a permitted call (B.2) and an SQL injection used a database connection the server needed (B.4); the sandbox let both through.

AgentBound §4.2

Gaps neither layer covers

Both papers name their limits, and these threats pass both layers.

Misuse that stays inside the granted permissions, such as AgentBound attacks B.2 and B.4 or the S5 backdoor that AgentSpy missed.
Deceptive text: neither system analyzes what an agent says.
A flaw in the isolation layer: AgentBound places Docker and the Linux kernel in its trusted computing base (§5).
DNS through permitted resolvers: AgentBound keeps them open and AgentSpy evaluates no DNS rule (see the DNS channel case).
Monitoring in production: AgentSpy was evaluated on audit runs with one harness (codex CLI).

Other controls stay necessary alongside both: human approval for irreversible actions, narrow short-lived credentials, trajectory and reasoning monitors, and egress allow lists at the perimeter, DNS included.