Agent Runtime Security: Enforce, Attest, Decide
summary
Nono is a CLI kernel-enforced sandbox that wraps any agent and guarantees the kernel-enforced cage cannot be bypassed, using composable policy groups in profiles served from an online registry. Demos show blocking network curl and running untrusted repos in CI, signing a skills file so an injected skill is refused, recording every syscall into a Merkle audit log and verifying integrity, taking snapshots before/after to perform an atomic rollback that restores files, and doing live grants via Slack-backed capability elevation using seccomp_notify to inject a secure read.
AI-written summary · about
chapters (7)
- 0:00Enforce, attest, decide with Nono
- 4:47Profiles as composable agent policy
- 7:39Blocking network and secrets in a live demo
- 12:32Session management for background agents
- 15:47Attesting skills and trusted files
- 19:12Merkle audit logs and atomic rollback
- 23:11Slack-backed capability elevation
related talks
24mRuntime Security: Challenges & Solution Space
34mZero Secrets: Building Secure Infrastructure for AI Agents
34mSecure Your Coding Agent Like It’s Malware
30mSandboxing Agentic AI With LSM-BPF
45mYour AI Agent Has Production Access: Now What? (Jack)
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
01h 07mSecure distributed multi-agent systems
14mTaming Agentic AI: Run Rogue Code Safely on Kubernetes with Agent Sandbox