The platforms assessed include Docker, E2B, Modal, Cloudflare, AWS and Google. According to the report’s own scorecard, no rival system fully met more than four of the 13 requirements. Kosa8 says its own platform met all 13, though the company wrote and conducted the research itself, a limitation that deserves editorial weight.
The framework is built on a deliberately pessimistic starting assumption: that an attacker has already gained root access inside the agent’s execution environment. From that baseline, the report asks what the compromised agent can still reach, and whether an organisation can reconstruct what it did.
The findings centre on a set of controls that the company says most platforms leave unaddressed. These include enforced two-person approval for high-risk actions at run time, network controls that block destinations outside a defined policy (including raw IPv6 and cloud-metadata endpoints), and a tamper-evident audit log suitable for offline verification by a third party.
On performance, kosa8 reported a median checkpoint time of 638 milliseconds and a rewind time of 520 ms for a running agent machine, including memory and processes. Eight attack scenarios were tested, covering exfiltration through a poisoned GitHub issue, a malicious npm package hunting for SSH keys, and an MCP tool “rug pull”. The company says kosa8 contained or fully handled all eight.
The report is candid about shortcomings. Sandbox creation takes around four seconds, slower than the warm-pool starts available from hosted cloud services. One restore path has an unexplained slow mode.
Source link
