AgentKernel: The Trust-Native Agentic Operating System

AgentKernel. The Trust-Native Agentic Operating System. By Zhenhua Zou and five others, from the DeepKernel Lab. Published on the twenty-ninth of August. No code repository is linked to it.

Modern AI agents cross trust boundaries as a matter of routine. They take in untrusted content, combine it with privileged instructions, keep intermediate beliefs in long-term memory, and call privileged tools. Put those together and there is an attack surface: a malicious payload can come in through the model's inputs and end up as a harmful tool action. The governance stacks meant to stop that are, today, application-level middleware. They run inside the same process trust boundary as the agents they are supposed to be watching.

The authors argue that agents need something underneath them: an operating-system substrate that provides mandatory, non-bypassable services for identity, for mediating inputs, for governing memory, and for controlling execution. AgentKernel is their proposal for it, a trust-native agent operating system whose starting premise is that security has to be a first-class design constraint rather than a layer added later.

AgentKernel wraps the whole agent lifecycle in a mandatory enforcement boundary, organised into four pillars: Identity, Perception, Cognition, and Execution. Each pillar takes classical operating-system security principles and adapts them to failures that happen at the semantic plane. The abstract lists four such failures: delegation abuse, prompt injection, memory poisoning, and tool misuse.

The design also makes a less obvious claim, that structural security is a capability multiplier and not only a cost. Identity managed by the kernel supports trustworthy collaboration across organisations. Graduated perception replaces brittle filters that sit at a single point. Memory under information-flow control improves retrieval fidelity while also limiting poisoning. And enforcement that runs from the semantic level down to the kernel lets an agent be given broader tool privileges, because those privileges sit behind a boundary it cannot bypass.

The support offered is analytical rather than a set of benchmark numbers. The authors use systematic comparison and security analysis to show how one integrated architecture can enforce security across the full agent lifecycle. They position AgentKernel as the missing operating-system layer beneath four kinds of existing tooling: orchestration frameworks, agent runtimes, governance platforms, and execution sandboxes.

At its root the objection is about placement, not about any single filter. Today's governance sits beside the agent, inside its trust boundary. AgentKernel moves it underneath, as mandatory services every part of the lifecycle passes through, and then claims a second payoff from the same move: once the boundary cannot be bypassed, the agent above it can be given more.