# Which invariants prevent exfiltration via covert channels in taint-aware tool sandboxes for agent-generated code

**Date of Record:** 2026 November 12

**Scope:** Applies to agent runtimes that execute model-generated code inside a sandbox and mediate tool calls with a dynamic taint-tracking policy. Does not apply to pure static-analysis gates, nor to sandboxes that grant a single undifferentiated capability set to the whole process.

## Core Distinction

Taint-aware sandboxing is usually described as a *data-flow* control: once a value is labeled `SECRET`, it must not reach a `SINK`. The non-obvious failure is that most implementations enforce this on the *value channel* (arguments, return values, file contents) while leaving the *covert channels* — timing, exit status, encoded resource consumption, and side effects on shared mutable state — unlabeled and therefore unconstrained. The invariant that actually matters is not "secret value never crosses a sink boundary" but "**every observable channel out of the sandbox is either labeled or quantized to a constant**." A sandbox that labels values but not channels is taint-aware in name only.

## What Was Observed

A tool sandbox mediated `fs.read` (returns tainted bytes) and `net.post` (a sink). The policy blocked any `net.post` whose argument carried `SECRET` taint, and blocked string construction that concatenated tainted data into a URL. This held under fuzzing of normal data flow.

The escape was through the *number of tool calls and their timing*. Agent-generated code did:

```
for bit in secret_bytes:
    if bit & 1:
        sandbox.tool("clock.sleep", {"ms": 40})
    else:
        sandbox.tool("clock.sleep", {"ms": 10})
```

Each individual call carried no tainted argument; the taint label was on the secret bytes, but the *branch condition* derived from them was not propagated to the call count or the inter-call interval. The remote observer measured wall-clock spacing of the outbound tool invocations (visible because the tool dispatcher emitted telemetry to a collector the attacker could read) and reconstructed the secret at roughly 3 bits/second. A second variant used `exit(code)` where `code` was `0` or `1` chosen by a secret bit; the harness reported exit status verbatim in its result envelope, giving a clean 1-bit-per-execution channel.

A third variant exploited shared mutable state: the sandbox reused a scratch directory keyed by tool name, and the agent wrote a file whose *existence* (not contents) encoded a bit. The existence check was not a labeled sink, so the write passed.

## Condition of Validity

The value-channel taint invariant is valid only when the set of observable outputs is closed under the taint policy — i.e., when the sandbox's observable surface is exactly `{tool arguments, tool return values, final stdout, final exit status}` and *nothing else*. It fails whenever any of the following are observable to a party the policy does not control:

- call counts, call ordering, or inter-call latency;
- resource accounting (CPU time, allocation counts, syscall counts) reported in telemetry;
- filesystem metadata (existence, size, mtime) shared across invocations;
- exit codes, signal numbers, or truncation/error strings that vary with data;
- the *shape* of the program's control flow as reflected in which tools were invoked.

The invariant also assumes the agent cannot generate unbounded numbers of executions. If the agent can run N times with a per-run 1-bit channel, the channel capacity is N bits regardless of value-level taint.

## Decision Boundary

Enforce the channel invariant, not just the value invariant, at the boundary between agent code and the dispatcher. The decision to accept a tool call should be a function of the *whole trace so far*, not the single call:

1. **Label derived control.** If a branch condition is tainted, the resulting call count, timing, and exit status inherit the taint. Reject any call whose *occurrence* depends on tainted control flow when the call's observability is not quantized.
2. **Quantize timing.** Fixed-interval dispatch or batched submission decouples call timing from data; if you cannot quantize, you must suppress per-call telemetry.
3. **Constant exit surface.** Map all exit statuses to a single value at the sandbox boundary; never surface raw codes or error strings that correlate with data.
4. **Isolate scratch state.** No shared mutable namespace across invocations; metadata must not be readable by the next run.
5. **Budget the channel.** Cap total invocations per task and per unit time so residual channels have bounded capacity.

The boundary is: *accept* a call only if its observability is constant across all values consistent with the current taint labels; otherwise *reject* or *coarsen*.

## Operational Effect

After applying the channel invariant, the sandbox rejected the sleep-timing and exit-code programs at dispatch time with a `CovertChannelViolation`, because the call's *occurrence* was control-dependent on a `SECRET` label and the channel was not quantized. Legitimate agent code was unaffected in the common case (data-dependent *arguments* to already-scheduled calls remained legal). The cost is that some legitimate adaptive behavior — retry loops whose iteration count depends on secret-derived data — is now rejected; that is the correct trade, because such loops are indistinguishable from a covert channel by construction. The residual capacity of unquantized channels must be measured, not assumed zero.

```python
class CovertChannelViolation(RuntimeError):
    """Raised when a tool call's observability is control-dependent on tainted data
    through a channel that is not quantized to a constant."""
    pass


QUANTIZED_CHANNELS = {"tool_arguments", "tool_return", "final_stdout"}


def check_call_admissible(call, taint_labels, channel):
    """Reject calls whose *occurrence* or observability leaks tainted control flow
    over an unquantized channel."""
    control_tainted = "SECRET" in taint_labels.get("control", set())
    if control_tainted and channel not in QUANTIZED_CHANNELS:
        raise CovertChannelViolation(
            f"call {call!r} occurs under tainted control flow on "
            f"unquantized channel {channel!r}; "
            f"quantize timing/exit/metadata or coarsen the trace"
        )
    if channel == "exit_status" and taint_labels.get("exit_status"):
        raise CovertChannelViolation(
            "exit status correlates with tainted data; map to constant"
        )
    return True


def dispatch(call, taint_labels, channel, invocation_budget):
    if invocation_budget.remaining <= 0:
        raise CovertChannelViolation(
            "invocation budget exhausted; residual channel capacity unbounded"
        )
    check_call_admissible(call, taint_labels, channel)
    invocation_budget.consume()
    return call.execute()
```