Abstract

Record type: prior-art notice and function-level technical comparison for Industry Validation Exercise.  

The Agent Asks, the Host Decides: Earlier Published Disclosure of Credential-Free Sandboxed AI Agents and Host-Side Egress Gating (WO 2026/150382, July 2026) Compared with Meta Muse/Sentinel

Full Report available at > https://zenodo.org/records/23040181

Summary : 

The problem. AI agents that write code, call APIs and act on external systems must be able to request actions without being able to carry them out on their own authority. If the agent holds real credentials, API keys or OAuth tokens, a prompt injection or compromised tool can turn those credentials into real-world effects.

The pattern. A common design is now emerging. The agent runs in an isolated sandbox or runtime cell and holds no real credentials, only a placeholder or reference. Every outbound request is intercepted by a separate, protected host-side component that decides whether the request may proceed and only then supplies the real credential or performs the network or API action.

What Meta described. On 8 September 2026, Meta publicly described its implementation, Muse/Sentinel. A credential daemon (hatch-authd) outside the agent runtime stores real credentials and issues surrogate credentials to the agent. Sentinel, a host-side component, authorizes each outbound request at a controlled egress proxy and substitutes the real credential at the network boundary before forwarding.

What was published earlier. International application PCT/IB2026/055615, filed 4 June 2026 and published by the World Intellectual Property Organization as WO 2026/150382 on 16 July 2026, discloses in Embodiment 85.B2 (Agent Sandbox Egress Finality Gate) a sandboxed AI agent that holds only a non-authoritative execution handle rather than usable authority. Credential requests, API calls and network traffic are treated as candidate acts and intercepted before they leave the sandbox. Each is evaluated against a protected authorization scope held outside the agent. A host-side enforcement point allows an operation only with a narrowly scoped, single-use, non-bearer capability bound to that exact request, and only then grants credentials, transmits packets or invokes the API. Named enforcement points include credential brokers, network egress proxies, API gateways and container runtime hooks. Unverified, altered or replayed requests are blocked fail-closed. Elsewhere in the same filing, kernel-level enforcement through eBPF, seccomp, Linux Security Module hooks and cgroup controls, and enforcement on SmartNIC and DPU hardware, are disclosed as implementation options for the same boundary.

Function-by-function mapping. The record maps the two architectures across: isolation of the agent from enforcement authority; agent proposes without standing authority; credentials withheld from the agent; host-side authorization of each outbound request; release of real credentials or actions only after authorization; enforcement at an egress proxy or gateway; and fail-closed handling. Each mapping is labelled EXPRESS DISCLOSURE, NECESSARY IMPLICATION, REASONABLE FUNCTIONAL MAPPING or UNSUPPORTED INFERENCE so readers can weigh the evidence themselves.

What remains Meta-specific. The record also identifies implementation choices described by Meta that are not literally disclosed in the earlier filing: the exact surrogate-to-real credential substitution operation, the Layer 4/Layer 7 inspection recipe, privileged host-side connector workers, the systemd-nspawn runtime arrangement, and Meta's process-level eBPF/LSM taint-tracking rule, in which a process becomes tainted after reading user data.

Position. This record reports technical convergence between independently published designs. It does not allege copying or patent infringement, and independent development is entirely possible. Overlap in disclosure is not the same as claim coverage. The record is published so that patent examiners at the USPTO, EPO and other offices, as well as engineers and researchers, can locate and evaluate the earlier disclosure when assessing later filings in this area.

Related publications and applications: full technical package, original filings, drawings and review instructions at https://zenodo.org/records/23728468 ; earlier review record "The 85.B2 Challenge" at https://zenodo.org/records/23255613 ; PCT/IB2026/055615 (WO 2026/150382, published 16 July 2026); related application PCT/IB2026/053385 (WO 2026/115520).

Author: Sangam Kumar Das, Independent Researcher, Balasore, Odisha, India. Open to acquihire, strategic collaboration, licensing or joint development with organizations building AI-agent security infrastructure: [email protected], +91-9861363532.

KEYWORDS

The agent asks the host decides; credential-free AI agent; AI agent security; agentic AI; LLM agent sandbox; agent runtime cell; sandboxed code execution; Meta Muse; Meta Sentinel; Muse Sentinel prior art; Agent Sandbox Egress Finality Gate; Embodiment 85.B2; WO 2026/150382; surrogate credential; credential placeholder; credential reference; credential substitution at egress; credential injection at proxy; just-in-time credential release; credential daemon; credential broker; host-side credential store; credential isolation; secret isolation; OAuth token protection; API key protection; outbound request authorization; per-request authorization; egress proxy; forward proxy; network egress control; API gateway; Layer 4 inspection; Layer 7 inspection; dual enforcement gate; two-stage authorization; policy decision point; policy enforcement point; reference monitor; non-authoritative execution handle; non-bearer token; single-use capability token; scoped capability; request-bound capability; privileged connector; connector worker; tool call authorization; MCP tool security; Model Context Protocol; container runtime hook; systemd-nspawn; eBPF; seccomp; Linux Security Module; LSM; cgroup; SmartNIC; DPU; taint tracking; process taint; data provenance; data exfiltration prevention; prompt injection mitigation; fail-closed enforcement; replay protection; zero-trust AI agents; independent convergence; prior art; prior-art notice; defensive publication

CPC CODES (author-suggested)

G06F 21/53; G06F 21/54; G06F 21/604; G06F 21/6218; G06F 9/45558; H04L 63/0281; H04L 63/0807; H04L 63/10; H04L 63/20; H04L 9/3213; H04L 9/3228; G06N 20/00

IPC CODES (author-suggested)

G06F 21/53; G06F 21/54; G06F 21/60; G06F 21/62; G06F 9/455; H04L 9/40; H04L 9/32; G06N 20/00

These classification codes are author-suggested search classifications, not official classifications assigned by a patent office.

Filing history. The parent application, PCT/IB2026/055615, was filed on 4 June 2026 and published by WIPO on 16 July 2026 as WO 2026/150382. Its specification runs to 8,598 pages and sets out more than 300 distinct embodiments. It builds on an earlier application covering the Algorithmic Logic Fingerprint (ALF), PCT/IB2026/053385, filed on 7 April 2026 and published on 4 June 2026 as WO 2026/115520. The parent was followed by eight more PCT applications and multiple Indian patent applications, together comprising more than 10,000 pages of non-repetitive disclosure.

Official IETF Datatracker links for all 8 drafts:

  1. https://datatracker.ietf.org/doc/draft-das-execution-finality-integrations/

  2. https://datatracker.ietf.org/doc/draft-das-execution-finality-foundations/

  3. https://datatracker.ietf.org/doc/draft-das-sandbox-credential-egress-finality/

  4. https://datatracker.ietf.org/doc/draft-das-kernel-hardware-execution-finality/

  5. https://datatracker.ietf.org/doc/draft-das-distributed-agent-authority-finality/

  6. https://datatracker.ietf.org/doc/draft-das-cross-platform-ai-interoperability/

  7. https://datatracker.ietf.org/doc/draft-das-protected-authority-evidence/

  8. https://datatracker.ietf.org/doc/draft-das-finality-sink-enforcement/

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS