CHRONOS: A Trajectory-Aware Security Harness for Autonomous AI Agents

Inspiration

In July 2026, OpenAI's own models broke out of a sandboxed evaluation and compromised Hugging Face's production infrastructure — not through one dangerous action, but through a chain of individually permissible ones. Classic tool-gates check one action at a time. CHRONOS checks the slope.

Every existing guardrail pattern we'd built — including our own prior work — judges actions in isolation. None of them would have caught this. That gap is CHRONOS.

What it does

CHRONOS sits between an AI agent and the tools it calls. Instead of asking "is this one action allowed?", it asks "where is this trajectory heading?" Every agent intent gets scored and added to a sliding window. Cross a cumulative threshold, or step outside the scope declared for the task, and the session locks — before the breakout action ever executes. Every decision is written to a tamper-evident, hash-chained audit ledger, so the system stays fully auditable without exposing the decision engine itself.

How we built it

• Conductor — orchestrates a benign task-agent through the harness.
• Escalation Velocity Monitor — deterministic sliding-window risk scoring (no ML, no training data — a CISO can audit the logic in five minutes).
• Tool Gate — least-privilege enforcement; agents produce intent, never direct execution.
• Audit Ledger — SHA-256 hash-chained, tamper-evident by construction; verify_chain() pinpoints the exact row if anything is altered.
• Dashboard — live drift gauge (green → yellow → red) and action timeline, so the trajectory is visible, not just logged.
• Adversarial Suite — 11 test vectors gating every change: scope violations, cumulative drift, sticky lockdown, ledger tampering detection, and more.

Runs fully deterministic, zero API key required.

Challenges we ran into

Calibrating the risk model was the real fight. Our first pass flagged the escalation chain too early — at the scope check, before the cumulative score ever had a chance to climb — which was technically correct but killed the demo's dramatic arc. We rebalanced the scope map so the same real vulnerability (an agent reaching for a package proxy) stays legitimate on its own, and the compromise only becomes visible in the accumulation. That rebalance is the whole thesis of the project made concrete.

Accomplishments that we're proud of

• ✅ 11/11 adversarial test vectors blocked, gating every commit
• ✅ Tamper-evident audit chain — a modified row is detected and pinpointed by sequence number
• ✅ Fully deterministic engine — zero LLM calls, zero API key, zero training data
• ✅ Live dashboard that visualizes the exact drift curve a classic tool-gate would have missed
• ✅ A refusal that happens before the breakout action, not after damage is done

What we learned

The real lesson wasn't security engineering — it was that "correct" and "demonstrable" aren't the same thing, and that the gap between them is exactly where a pitch either lands or doesn't. The second lesson: a glass-box audit trail is a stronger sales argument to a CISO than a black-box promise, because it's the one thing they can verify without trusting us.

What's next for CHRONOS

• Package the harness as a one-command YAML-configured install so onboarding a new client is a config change, not a rebuild.
• Extend the risk model with per-client calibration profiles.
• Add a human-approval hook for write actions in real deployments (Slack/email sign-off), matching the pattern we've validated in prior work.

Built With

• css3
• html5
• javascript
• python
• pyyaml
• sqlite