How to Limit an Autonomous AI Agent: A Guide to Hard Stop

What You Will Need

• A Linux machine (tested on Ubuntu 22.04).
• Python 3.9+.
• Docker installed (for isolating the agent).
• sudo privileges.
• A basic understanding of how cgroups and namespaces work.

Step 1. Create an Isolated Environment for the Agent

The agent must run in a container without network access. Use Docker with networking disabled.

docker run -it --rm --network none --name agent-sandbox ubuntu:22.04 bash

Inside the container, install only the necessary packages. For example, Python and curl (for local tests).

apt update && apt install -y python3 curl

Verify that the network is unavailable:

curl -s http://example.com || echo "Network unavailable"

Step 2. Configure cgroups to Limit Resources

Create a cgroup v2 and set CPU and memory limits. This will prevent the agent from exhausting resources.

sudo mkdir /sys/fs/cgroup/agent
sudo sh -c 'echo "max 50000" > /sys/fs/cgroup/agent/cpu.max'
sudo sh -c 'echo 512M > /sys/fs/cgroup/agent/memory.max'

Move the agent process into this cgroup. First find out the PID of the process inside the container, then run on the host:

AGENT_PID=$(docker inspect -f '{{.State.Pid}}' agent-sandbox)
sudo sh -c "echo $AGENT_PID > /sys/fs/cgroup/agent/cgroup.procs"

Step 3. Install Hard Stop — the System Call Interceptor

Hard Stop (the forced-stop system) operates at the kernel level and blocks dangerous operations. Use an eBPF program that monitors calls to execve, open, connect and kills the process when a policy is violated.

Create the file hard_stop.c:

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/syscalls/sys_enter_execve")
int handle_execve(void *ctx) {
    char comm[16];
    bpf_get_current_comm(&comm, sizeof(comm));
    if (comm[0] == 'a' && comm[1] == 'g') { // agent process name
        bpf_printk("Blocked execve for agent\n");
        return 0; // block
    }
    return 0;
}

Compile and load:

clang -O2 -target bpf -c hard_stop.c -o hard_stop.o
sudo bpftool prog load hard_stop.o /sys/fs/bpf/hard_stop

Note: the code is simplified for demonstration. In real use, use the libbpf library and check the return value.

Step 4. Configure the Stop Policy

Define which agent actions are considered dangerous. For example, prohibiting connections to external IPs, writing to /etc, launching interpreters. Describe the rules in JSON format:

{
  "blocked_syscalls": ["execve", "connect", "open"],
  "allowed_paths": ["/tmp", "/home/agent"],
  "blocked_ips": ["0.0.0.0/0"]
}

Load the policy into the eBPF program via a map. Example in Python using bcc:

from bcc import BPF

bpf_text = """
#include <uapi/linux/ptrace.h>
BPF_HASH(policy, u32, u8);
int kprobe__sys_execve(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid();
    u8 *blocked = policy.lookup(&pid);
    if (blocked) {
        bpf_trace_printk("Blocked execve for PID %d\\n", pid);
        return -1; // block
    }
    return 0;
}
"""
b = BPF(text=bpf_text)
# Populate policy for the agent PID
agent_pid = 1234  # replace with the real PID
b["policy"][b.ctypes.c_uint(agent_pid)] = b.ctypes.c_ubyte(1)

Step 5. Verify That Hard Stop Works

Start the agent and try to perform a prohibited action. For example, from the container try to run curl to an external site.

docker exec agent-sandbox curl -s http://example.com

Expected result: the command fails, and a record of the block appears in the kernel logs.

dmesg | tail -5

You should see the message Blocked execve for agent.

Step 6. Configure Automatic Stop on Anomalies

Add system call monitoring. If the agent attempts a suspicious sequence (for example, opening a file and then launching a process), Hard Stop should kill the process.

Use bpftrace for a simple script:

sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat /comm == "agent"/ { printf("Agent opened file: %s\n", str(args->filename)); }'

If necessary, add a condition and call kill(pid, SIGKILL) via eBPF.

Common Mistakes and How to Recognize Them

• The agent bypasses the block through child processes. Hard Stop must inherit the policy for new PIDs. Verify that in the eBPF program you monitor fork and copy the rules.
• The network is still accessible. Make sure the container is started with --network none and there are no other network interfaces. Check ip addr inside the container.
• Hard Stop does not load. The error BPF program load failed is often related to missing privileges or an incompatible kernel version. Check uname -r and the presence of CONFIG_BPF_SYSCALL=y.
• The agent uses legitimate calls to escape. For example, open on /proc/self/mem. Restrict access to /proc by mounting --mount type=tmpfs.
• Logs do not show the block. Make sure bpf_printk is enabled and dmesg is not overflowing. Use trace_pipe for debugging.

By following these steps, you will create a basic barrier that stops the agent before it causes damage. Remember: no system provides an absolute guarantee, but Hard Stop reduces the risk of uncontrolled behavior.