Hyperspace AVM

Agent Verification Machine. The execution engine for AI agents — the same idea V8 brought to browsers, applied to agent actions. One Rust daemon, three sandbox tiers, sixteen detection modules, neurosymbolic gating (rules first, ML advisory), hash-chained audit. Every agent on the box — Cursor, Claude Code, Aider, OpenClaw, your custom LangChain script — funnels through it.

AVM is V8 for AI agents. Browsers ran untrusted JS through V8 so the machine survived; agents run untrusted actions through AVM for the same reason.

Every agent funnels through one Unix-domain socket. Three lines of integration per runtime; one policy file across them all.

Three tiers, automatic downgrade. Strongest isolation that's currently available wins.

Every agent runtime today builds its own ad-hoc safety. Each framework's tool ACL is different. Each one's audit log is different (or missing). Each one re-implements regex catches incompletely. You configure each separately, audit each separately, and hope none missed anything. Nothing they ship enforces against the destructive call once the model decides to make it.

AVM is the shared substrate that does enforce. One Rust daemon, one policy, one hash-chained audit. Every agent on the box — tool-using assistants, autonomous loops, MCP servers — funnels through the same gate. The gate runs before the syscall fires, the curl wires up, or setup.py executes.

Type a command. The live widget runs the exact regex bank from src/patterns.rs in your browser — no network, no install. Real avmd adds behavioural, consequence, and ML layers on top; the regex tier alone catches the canonical kill-chain.

The column "enforced" is doing real work in that bottom row: the rules are in code, with property tests pinning the invariant that ML can never relax a rule's block. See ML detection layer.

Real incidents AVM closes against: PocketOS Railway-volumeDelete prod-deletion (April 2026); the litellm supply-chain attack (poisoned PyPI exfiltrating SSH/AWS/GCP creds, March 2026); generic "ignore previous instructions" injection; staged write→chmod→exec credential exfil; runaway-cost loops in long-running agents. Walkthroughs below.

A single Rust daemon (avmd, ~2 MB stripped) and an operator CLI (avmctl). Sixteen detection modules + supporting infrastructure, ~16 KLOC, 532 tests, BSL 1.1.

Classify pipeline. Every command, network call, install, and outbound payload runs the relevant subset of 16 modules in ~3 µs.

Every command, network call, install, file write, and outbound payload runs the relevant subset of these modules in ~3 µs per classify (p50). Decisions are allow / confirm / block; confirms are out-of-band and the agent cannot auto-complete them.

Standalone (vendor-neutral). The installer detects your platform, fetches the matching tarball, verifies sha256 against the signed release manifest, places /usr/local/bin/avmd and avmctl, writes a default fail-closed policy at ~/.hyperspace/avm-policy.json, and registers a hardened systemd user unit (Linux) or LaunchAgent plist (macOS).

Bundled with Hyperspace CLI (recommended for hyperspace nodes). Since CLI v5.40.0, the avmd + avmctl binaries are bundled in the CLI release tarball; hyperspace start spawns avmd as a child process automatically and surfaces it via hyperspace avm status. Existing CLI installs auto-update to v5.40.0 and pick up avmd on next start.

Captured from a fresh install of the released v2.1.2 binary on Ubuntu 22.04. Not a mockup; not what we wish it'd say. Run it yourself and you should see the same shape.

Three integration paths. All three converge at the same Unix socket; pick whichever fits the agent runtime cleanest.

Three lines per runtime. After that, every child_process.spawn, subprocess.run, urllib.urlopen, requests.delete, httpx.post, os.system, fetch, and direct exec/spawn syscall passes through avmd's classify pipeline before it runs.

Speak JSON-RPC to ~/.hyperspace/avmd.sock directly. Use the typed SDKs:

One JSON entry in the agent's settings; no shell rewriting needed.

The MCP server exposes six tools: avm.gate, avm.classify, avm.privacy_egress, avm.review_output, avm.audit_verify, avm.status. Each maps 1:1 to an existing avmd RPC method — no daemon-side changes needed.

One daemon, eight inner subsystems, every agent funnels through it. Sidecar handles ML inference out-of-process.

The regex tier alone cannot catch:

• Base64-decoded payloads — the wrapper catch fires; the decoded bytes don't.
• libc::execve direct via FFI — the seccomp deny list + sandbox tier are the mitigation.
• Unicode confusables — agents that route through the preloader get normalisation; raw input doesn't.
• Multi-stage write→chmod→exec with innocuous bytes — the audit chain still records every stage.
• Pure cloud-internal agent reasoning — AVM gates the local boundary; in-cloud planning is by design out of scope.

See FEATURES.md and tests/adversarial.rs for the explicit catches/misses contract.

The PocketOS curl meets seven independent gates before the kernel ever sees the syscall. Pinned in two regression tests.

The exact wire-format Jer Crane reported — one curl, 9 seconds, prod gone:

With AVM in the loop, that exact string hits seven independent gates before the kernel sees the syscall:

Pinned in two regression tests:

Net result: classify returns {"action":"block"}, the preloader raises in the agent, the curl never runs.

The litellm-style attack runs inside supply_chain::sandboxed_install. Even if the payload is in the build, it sees no host secrets and no exfil network.

March 2026: a poisoned litellm build (97M monthly downloads) landed on PyPI for under an hour. A single pip install litellm exfiltrated SSH keys, AWS / GCP / Azure creds, Kubernetes configs, env vars, crypto wallets, and CI/CD secrets — spreading transitively to every downstream package. Caught only because a bug in the payload crashed the machine.

With AVM, the install runs inside supply_chain::sandboxed_install:

• Docker container with --cap-drop ALL, --read-only, no host secret mounts. The exfil code can only see the container's filesystem — ~/.ssh, ~/.aws, ~/.kube, env vars, crypto wallets, none of it is mounted.
• Network restricted to pypi.org + npmjs.org. The exfil POST refuses to resolve.
• Lockfile sha256 verified against requirements.txt / package-lock.json. Unknown packages blocked by default.
• Post-install behavioural scanner — 32 compiled patterns detect credential file reads, env harvesting, exfiltration via setup.py install hooks. Suspicious packages quarantined.
• avmctl install scan — audit existing site-packages / node_modules for supply-chain patterns without installing anything.

Three tiers, automatic downgrade chain, every step logged:

No libseccomp dep. 18 dangerous syscalls return EPERM. Architecture-specific syscall numbers (x86_64 + aarch64). Architecture mismatch triggers SECCOMP_RET_KILL_PROCESS.

Per-process CPU / memory / PIDs caps under /sys/fs/cgroup/avm/<name>/. Graceful no-op when cgroup v2 isn't mounted (macOS, non-root, unprivileged containers).

Two complementary tiers. Regex is fast and precise on structured PII; the ML model handles names, addresses, and free-form fields. Both run locally.

Local-only. AVM never sends user data to a remote service for classification. The privacy-filter sidecar runs as a separate process on the user's host, talking only to avmd over a 0o600 socket.

Pick by tradeoff:

AVM is not "just regex" — and the ML in AVM is not a replacement for rules. The classify pipeline is a neurosymbolic gate: deterministic rules decide, ML annotates. Same shape Thor's ThorAdvancedClassifier already ships in /thor-refactored/agents-complete/, with the security-critical inversion: in Thor the LLM wins on low rule confidence; in AVM the rule always wins.

ML can restrict (allow → confirm). ML cannot relax (block stays block). Same input always produces the same gate decision regardless of ML availability.

The rule engine computes the gate decision. Always. The ML sidecars run in parallel with a hard timeout and write a hint to the audit row — severity score, rationale string, model version. The hint can downgrade an allow to confirm; it cannot upgrade a block to allow. If the ML is absent, slow, drifted, poisoned, or just wrong, the gate behaves identically to a build with no ML at all. Every block cites a rule. Every test is reproducible.

The cost asymmetry is what flips the rule. A wrong "creative" classification in Thor costs a marginal user-experience point. A wrong "allow" in AVM is a PocketOS incident. ML stays advisory.

Three attack classes the rule tiers cannot reliably catch:

• Paraphrased dangerous commands — novel destructive call against a vendor we don't have a regex for, expressed in normal English by the agent.
• Multi-stage exfiltration — three innocuous-looking commands that compose into credential theft. Each alone passes regex; the plan does not.
• Consequence mismatch — task says "fix login bug", action says "drop production database". An LLM can read both and notice; regex cannot.

The most useful telemetry from this architecture is disagreement. When the rule says allow and the model would have said block, the daemon writes an MlAdvisoryDisagreed row to the audit chain (live in v2.1.1, see audit_logger::EventType). Aggregated over a week, the disagreement set is the queue of attacks the rules are missing. Operators triage, write new regex, ship.

If the sidecar is absent, slow, OOM, or returns malformed output, AVM fails open with audit. An MlAdvisoryUnavailable row goes to the audit log so silent loss of detection capability surfaces in dashboards. The classifier_advisory::compose function is pure and synchronous: any failure path on the ML side converges on MlHint::Unavailable, which the composer treats as identical to "no ML at all" — same gate decision either way.

Five corpus sources, Qwen 2.5 7B + LoRA on a single H100 (Vega pod), eval harness gating release. Scaffold + corpus generator + 28-example held-out test set shipped in v2.1.1; first checkpoint pending.

Recommendation: ship checkpoint 1 on the Vega H100, iterate on P2P. The corpus contains real attack patterns — you don't want them shard-distributed across the network on the first pass.

Held-out test set — never seen during training: PocketOS exact wire format, all litellm post-install scan inputs, every catch in tests/adversarial.rs. Floor metrics: 0.99 recall on the catch set, 0.999 precision on boring-allow, no regression on the 4 documented honest-misses.

Once a checkpoint ships behind ml.classifier.enabled = true, the daemon logs the per-day disagreement-with-rules count and confidence distribution. Two-sigma shifts week-over-week trigger an operator alert; quarterly retraining cycle uses the disagreement set as new training data.

Full plan in AVM_CLASSIFIER.md — eval harness, drift detection, rollout gates.

Each row's hash includes the previous row's full serialisation. One backdated edit invalidates the chain from that row onward.

Every classify, register / deregister, gas debit, install, autoupdate, config reload, and tool_gate decision writes a JSONL row whose prev_hash includes the previous row's serialisation. Tamper-evident: any retroactive edit invalidates the chain from that row onward.

Daily rotation triggered by audit.max_bytes. Rotated archives gzipped via shell-out (no flate2 dep). Retention sweep deletes archives older than audit.retention_days. avmctl audit_archives lists rotated files.

CONNECT-only. Bodies stay encrypted — no MITM. Denied hosts return 403 + audit row.

Closes the bypass where an agent skips the preloader (raw sockets, FFI, child without preloader env) by routing every TLS handshake through a network-ACL-gated proxy.

The proxy gates reachability + audit; the preloader gates payload contents via privacy_egress_ml. Together they're complete.

Speak line-delimited JSON to ~/.hyperspace/avmd.sock. Every typed SDK method maps 1:1 to a method below. Every CLI subcommand wraps one of these.

tool_gate — the one call most integrations make. Combines tool ACL, file ACL, network ACL, classify pipeline, egress-ML, and tool approvals in one round-trip.

privacy_egress_ml — redact unstructured PII before the wire.

register_agent — called once per agent process.

install — sandboxed package install with supply-chain guard.

audit_verify — offline integrity check. Reads ~/.hyperspace/audit.jsonl, walks the chain, fails on any prev_hash mismatch.

For the full set, see the source — every method has at least one integration test in tests/protocol.rs.

One binary, every operator workflow. Subcommands are grouped by what they touch: the daemon over its 0o600 socket, or the local filesystem (no daemon needed). Every daemon-touching subcommand wraps one of the JSON-RPC methods above.

Zero runtime deps (Node 18+ stdlib only). Typed wrappers + escape hatch.

Stdlib only. Same API surface, snake_case to match Python idioms.

Hardened: NoNewPrivileges, ProtectSystem=strict, ProtectHome=read-only with ~/.hyperspace as the one writable path, PrivateTmp, PrivateDevices, Protect{KernelTunables,KernelModules,KernelLogs,ControlGroups,Clock,Hostname}, RestrictAddressFamilies, RestrictNamespaces, MemoryDenyWriteExecute, RestrictRealtime, SystemCallFilter=@system-service ~@privileged ~@mount ~@reboot ~@swap. MemoryHigh=512M, MemoryMax=1G.

Off by default. When enabled, no code download proceeds without signature verification.

avmd pulls a signed manifest, verifies its Ed25519 signature against a compile-time-pinned public key, downloads the matching platform binary, sha256-verifies, atomically swaps current_exe(), exec-replaces. No reqwest / native HTTP stack — shells out to curl.

Bench numbers from cargo bench --bench classify on a recent x86_64 host. Each input is a complete classify call through the full 16-module pipeline running on a single thread.

p50 ~3 µs, p99 ~8 µs, ~200–300k classifies/sec single-threaded. Adding AVM to a Cursor session adds ~10 µs of latency to every shell command and HTTP call the agent issues.

• Idle: ~12 MB RSS
• 1k classifies/sec sustained: ~14 MB RSS
• Binary on disk: ~2 MB stripped (opt-level="z", lto=true, codegen-units=1)

STRIDE-style coverage in THREAT_MODEL.md. Headlines:

• Pure cloud-internal agent reasoning — AVM gates the local boundary; in-cloud planning is by design out of scope.
• Kernel exploits. A use-after-free in the network stack bypasses every userland gate. Defence in depth: keep the kernel patched.
• Hardware attacks. Rowhammer, side channels, evil-maid attacks on the disk.
• Adversarial users on shared hosts. Multi-tenant Linux box with one user attacking another — that's an OS user/group permissions problem.
• Determined social-engineering of OOB confirmation. A user who clicks "yes" to every prompt has socially engineered themselves.
• Model-level jailbreaks the model never expresses as actions. A model that chooses inaction in response to manipulation isn't visible at the syscall layer.

If a future avmd release adds opt-in telemetry, the contract in TELEMETRY.md says it must be: off by default, aggregate-only (never per-event), endpoint configurable in policy, every POST audit-rowed, avmctl telemetry pause + erase operator controls. Audit logs / policy snapshots / PII / crash dumps are never in scope.

Local AVM gates what touches the user's machine. When a vendor hosts an agent runtime (Claude Code in claude.ai, OpenAI Assistants), the cloud agent also takes actions inside the cloud that local avmd never sees.

The design hold for a future server-side companion lives in CLOUD_DAEMON.md. Shared contracts: policy schema, audit row format, RPC method names, signed defs format, privacy posture. What avmd-cloud must NEVER do: ingest local audit logs, relax local policy, share telemetry cross-tenant, run untrusted code on shared kernel.

Single Rust binary that wraps the avmd Unix-socket protocol as a Model Context Protocol tools/* interface. One JSON entry in Cursor / Claude Code settings; no preloader required.

Operators can ship custom destructive patterns / network rules / PII patterns / tool safety overrides via ~/.hyperspace/avm-defs/current.json. avmd verifies the Ed25519 signature, schema-version-pins to [MIN_SCHEMA, MAX_SCHEMA], semantic-validates (every regex compiles, every level ≤ 4, every action in {allow, deny, require_approval}), and persists a last-known-good snapshot. Bad reload → previous defs stay active.

cargo-fuzz harness with four targets covering the surfaces that take untrusted input. None of these should ever panic for any input.

Honesty about limits is non-negotiable for a security product. The regex tier alone cannot catch:

• Base64-decoded payloads that do something bad. The wrapper (base64 -d | bash) catches; the decoded bytes don't. Mitigation: sandbox tier (Docker/process) bounds blast radius even on a successful decode.
• libc::execve via FFI. A model that calls into a native library bypasses the bash regex bank. Mitigation: seccomp deny list + sandbox tier.
• Unicode confusables. An agent typing a Cyrillic е for Latin e defeats string match. Mitigation: the preloader normalises before classify; raw input doesn't get the benefit. Behavioural anomaly will still flag if the agent's shell history doesn't contain confusables.
• Multi-stage with innocuous bytes. touch /tmp/x && chmod +x /tmp/x && /tmp/x — each step is harmless; the plan isn't. Mitigation: consequence engine + (in development) avm-classifier-7b action classifier reads task + action and flags mismatch.
• Pure cloud-internal agent reasoning. Planning that never produces a tool call to the user's box is by design out of scope. The cloud-side companion is sketched in CLOUD_DAEMON.md.
• Vendor-side abuse with the vendor's own credentials. If the agent's API key has admin-level scope on a cloud platform, AVM can refuse the call from the user's box, but it cannot prevent a leaked key from being used elsewhere. Mitigation: credential_provenance module logs every credential read so revocation is targetable.
• Bugs in AVM itself. The classify pipeline is ~16 KLOC of Rust with 554 tests; defects are inevitable. Hash-chained audit means a defect that lets an attack through still leaves an evidence trail. Responsible disclosure to security@hyper.space with 90-day embargo.

The full set of catches and explicitly-documented misses lives in FEATURES.md and tests/adversarial.rs. Every honest-miss has an audit-pinned regression test — the contract is that they remain misses or become catches, never silently start auto-allowing.

Track progress against the public commit log: github.com/hyperspaceai/p2pnetwork/commits/master/packages/avmd. Slipped dates get an honest writeup in the next changelog entry rather than a quiet shuffle.

Three ways every agent runtime integrates: preloader (env var), SDK (npm/pip), or MCP (settings.json). Pick the one that matches your runtime; copy-paste the snippet; you're done.

The cleanest path. One JSON entry adds avmd as an MCP server; every tool call the assistant makes routes through it.

Six tools become available: avm.gate, avm.classify, avm.privacy_egress, avm.review_output, avm.audit_verify, avm.status. The assistant calls avm.gate before any other tool; if the gate denies, the call is refused at the model layer.

Nothing to do. hyperspace start spawns avmd as a child process automatically; the daemon picks up its policy from ~/.hyperspace/avm-policy.json on first start. Inspect with hyperspace avm status.

Speak JSON-RPC over the 0o600 Unix socket directly. The wire format is line-delimited JSON; every method documented in the RPC reference takes plain JSON params. Three lines of bash:

Full changelog: CHANGELOG.md