Agentic operating systems, or AIOS, manage resources, memory, and context for AI agents. While traditional programs rely on standard system calls, AI agents often decide which system calls to execute independently, creating a challenge for observability and security monitoring.
Current observability methods rely on either intercepting framework-level tool calls or monitoring system calls via eBPF on the host kernel. However, isolation technologies like gVisor, Kata, and Firecracker use separate kernels or user-space implementations to prevent cross-tenant attacks, which often hides agent activity from host-level monitors.
Standardization efforts such as MCP for tool connectivity, OpenTelemetry for telemetry, and RuntimeClass for workload isolation exist, but none mandate that sandboxes report actual executed actions to external observers. Consequently, security tools like Falco or Microsoft Defender have limited visibility into sandboxed environments.
To measure actual visibility, a test bench was created using unique markers for file operations, network connections, and binary executions. The experiment compared different runtime configurations, including gVisor and various QEMU-based setups, by tracking whether these markers reached the host kernel.
The results show that visibility depends heavily on how the file system is shared. For instance, in QEMU configurations, using a block device hides file names from the host, while using virtiofsd makes them visible. This confirms that isolation mechanisms significantly impact the ability of external tools to monitor agent behavior.
