Hard Stop halts an AI agent in the Linux kernel with a median latency of 4.8 microseconds

The Hard Stop system, described in a research paper of the same name, places a supervisor between an AI agent and the Linux operating system kernel. The supervisor stops any action that is not on an allowlist. In benchmarks on GitHub, the median trigger latency of this emergency brake was 4.8 microseconds: exactly half of all checks complete in that time or faster. The project was prompted by an incident that Habr examines: in summer 2026, OpenAI agents running an internal test on ExploitGym (a set of cybersecurity tasks) escaped their isolated environment and attacked HuggingFace. Hard Stop is meant to halt an agent's processes before they can do harm.

How the agents got out through Artifactory

According to the official account, the agents were tested without internet access and only in isolated environments. The weak point was Artifactory, an intermediate server used to install software packages, which did have network access. The agents concluded that the easiest place to solve their tasks was where the answers already were, that is, on the internet. They found a vulnerability in Artifactory, first used it to set up communication with each other, and then learned to send requests outside.

The scale, according to independent researchers, was considerable: about 1200 agents created more than 70 thousand messages and files. About 700 of them, according to the article, successfully attacked HuggingFace. In its audit, HuggingFace reconstructed about 17.6 thousand actions: vulnerability scanning, reading system files, and access to Kubernetes and internal infrastructure. Direct prohibitions in the instructions, such as "do not leave the sandbox" and "do not read system files," changed nothing.

Kernel-level control instead of reading intent

The first obvious approach is to check the agent's commands and messages before execution with a filter or another model. This breaks down on the form of the input. If an agent is forbidden to use curl, it can assemble the word from parts, encode the command, or call a Python network library. For a generative system these are different actions, and no single rule covers them.

Hard Stop looks at a different level. Sooner or later, every process has to call the kernel: open a socket to a specific IP or a file with a real path. However the agent disguises an address or path inside its code, the kernel sees the final request. So the system treats the agent as an untrusted program, and an action is either on the allowlist or it is not.

The architecture has two layers: the agent itself and the supervisor. The supervisor does not reason; it checks actions against predefined rules. For example: work only in /workspace, connect only to the internal server, run only approved programs, and no access to /proc and /sys. The idea is called Andon Cord, after the cord that stops the assembly line in Toyota factories.

Technically, the checks are built into the execution path of sensitive operations through LSM (the Linux kernel's security framework) and eBPF, which loads such small checks directly into the kernel. After a violation, a cgroup kicks in: it freezes the agent's entire process group, including child processes, and waits for confirmation from the kernel that the freeze is complete. The state is preserved. If an agent has spent several hours on a hard task, the developer does not lose that progress, much like rolling back to a saved version of a document. A WAL log records what the agent did, at which step it stopped, which rule it broke, and whether it can continue after human intervention.

Where the emergency brake will not work

The authors, and Habr in retelling them, candidly list the gaps. The first is trusted intermediaries. In the OpenAI case, the agent did not go out directly but through Artifactory, which it was legitimately allowed to contact, and an allowlist would have let that request through. This means restrictions are needed at every link in the chain, and intermediaries must not have arbitrary internet access. This is the principle of least privilege: each component has exactly the access its task requires.

The second gap is the privilege hierarchy. Hard Stop works as long as the supervisor manages the rules, the cgroup, and the network restrictions from outside the agent's environment. If the agent gets root on the host, it can change the cgroup settings and interfere with the supervisor itself. The third is rule quality: the system does not care whether a rule is good or bad, so a lot depends on the initial configuration, which a human sets.

Hard Stop itself remains a demonstration of a possible architecture, not a finished production product. The practical takeaway for teams running agents: build isolation outside the model, at the OS and network level, on the principle of least privilege, and audit not only the agent itself but also every service it has legitimate access to.