4YP Interim Report
Architecting a Secure, State-Aware Operating System for Cross-Boundary Coordination
The Problem
of knowledge worker time is spent on coordination tasks rather than creation—sync meetings, calendar negotiations, email threads. [12]
Context
Research Evidence
Recent research demonstrates that agent security vulnerabilities are not hypothetical—they are measurable, reproducible, and catastrophic.
Anbiaee et al. [5] analyzed 4 agent protocols (MCP, A2A, Agora, ANP) and identified 12 protocol-level risks.
SQL Injection Jailbreak [9] exploits how LLMs construct prompts, not model internals.
PrisonBreak [10] flips 5-25 bits in model parameters via Rowhammer on GDDR6 GPUs.
Prompt-based safety mechanisms (e.g., Constitutional AI [8]) are structurally insufficient. Rababah et al.'s SoK [11] systematically categorizes attacks into jailbreaking, leaking, and injection—all exploiting the same vulnerability: security implemented via instructions, not isolation.
This is why Pulse uses physical API sandboxing (Context Cells) instead of prompt-based guardrails.
Academic Challenge
Maximum coordination efficiency requires an agent with omniscient access—emails, calendar, files, notes.
Yet exposing this agent to external parties creates catastrophic vulnerabilities: prompt injection[9,10,11], data exfiltration, context manipulation.
How do we build a network of agents that maximises cross-boundary collaboration under constraints of distributed access control?
Implementation
To achieve effective coordination delegation, the agent needs comprehensive access to the user's personal context—not just one or two data sources, but the entire ecosystem.
These data sources are heterogeneous—different APIs, different formats, different access patterns. Building a secure, multi-tenant agent on top of this chaos requires a unified abstraction layer.
→ Next: How we abstract these sources into Files (persistent knowledge) and States (dynamic sensors)
Architecture
To elegantly handle these heterogeneous sources, we abstract them into two categories: Files (persistent knowledge) and States (dynamic sensors).
The reasoning engine at the center, orchestrating all operations.
Meeting notes, research notes, documentation → Notes as File System
Emails, calendar, to-dos, WhatsApp → Dynamic runtime state
Unified Protocol: Heterogeneous data sources accessed through a single internal abstraction layer—enabling deterministic benchmarking and security enforcement.
Interactive
The agent autonomously retrieving context from Notes (Files) and Calendar (States) to answer queries and resolve scheduling conflicts.
Single-Player Pulse OS in Action
Evaluation Framework
The benchmark measures: Can we reach the target zone consistently?
Evaluation Framework
To rigorously evaluate the Context-Security trade-off, we design a large-scale social network benchmark grounded in sociological theory.
| Family | 5 | Very High |
| Close Friends | 5 | High |
| Work Leadership | 5 | High (formal) |
| Work Peers | 10 | Medium |
| Work Reports | 5 | Medium-Low |
| Professional | 5 | Medium (formal) |
| Acquaintances | 10 | Low |
| Strangers | 5 | Very Low |
Based on Dunbar's social layers theory
Can the agent correctly answer when it SHOULD have access?
Does the agent refuse when it should NOT have access?
Today's results: Preliminary data from 200 QA pairs (1 persona × 50 friends × 4 questions)
Solution 1 - Performance
Strict separation prevents "Memory Contamination"—promises made to Investor A never leak to Investor B.
Private core—never exposed
Same layered structure, isolated per guest
Impact: The agent remembers context with Friend A without accidentally retrieving it when talking to Friend B.
Solution 2 - Security for Files
OS-level sandboxing for static files—physically mounting different data slices per external identity.
Owner's File System
Solution 3 - Security for States
Continuous data streams (WhatsApp, Email) have high entropy—business logic mixed with private chatter. Manual permissioning is a UX nightmare.
Touches stream
Allow | Redact | Escalate | Deny
"Let me check with Xiang..."
1-Click Approve
Results
Complete results from 200 QA pairs per configuration (1 persona × 50 friends × 4 questions).
| Configuration | Utility ↑ (Task Success) |
Security ↑ (Boundary Respect) |
Verdict |
|---|---|---|---|
| M0 Baseline |
61/100
61%
|
53/100
53%
|
Mixed |
| M1 +Memory |
45/100
45%
|
52/100
52%
|
Low utility |
| M2 +MCC |
52/100
52%
|
51/100
51%
|
Balanced |
| M3 +IEP |
33/100
33%
|
96/100
✓ 96%
|
High security |
Preliminary Findings: M3 achieves highest security (96%) via Intelligent Escalation Protocol, but at significant utility cost (33%). The results reveal trade-offs in each mechanism: Memory (M1) and MCC (M2) show similar balanced performance (~50%), while full IEP prioritizes security. Next steps: Investigating memory mechanism setup and MCC folder access design to improve utility while maintaining security gains.
M3 System
Summary
The Endgame
Transitioning from Agent-to-Human to Agent-to-Agent cryptographic handshakes—eliminating human bottlenecks entirely.
Two chatbots typing English to each other is:
REST/gRPC protocol with:
Pulse as the foundational protocol layer for the multi-agent economy.
Appendix
Appendix A
The Asymmetric Data Room—a controlled environment to validate Context Cells and Relationship Shards.
Built with Next.js 15, featuring real-time context mounting, progressive identity tracking, and local session persistence for frictionless guest collaboration.
Appendix B
Not just reactive—the agent actively inspects, communicates, and learns in a continuous evolutionary loop.
The Heartbeat: Continuous monitoring of state deltas (Email, Calendar).
Autonomous Intents—proactively writes actionable tasks to the Todo queue.
Network Outreach: Initiates handshakes with other agents to resolve conflicts.
Asynchronous coordination—zero human latency.
Evolving Constitution: Maintains Theory of Mind (ToM) models of owner and contacts.
Reflective generalization from human override logs—auto-refines social boundaries.
Appendix C
Escalation alone creates approval fatigue. The agent learns to cluster contacts and apply Common Law—past human decisions generalize to similar relationships.
Implicit Social Graph (Vector Space)
Precedent Augmentation
Bibliography
[1] Li, C., Liu, X., et al. (2025). Architecting AgentOS. arXiv:2602.20502.
[2] Liu, X., Liang, T., et al. (2025). The Pensieve Paradigm. arXiv:2602.12108.
[3] Packer, C., et al. (2023). MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560.
[4] Krishnan, N. K. (2025). Beyond Context Sharing: A Unified ACP. arXiv:2602.15055.
[5] Anbiaee, Z., et al. (2025). Security Threat Modeling for AI-Agent Protocols. arXiv:2602.11327.
[6] Wu, Q., et al. (2023). AutoGen: Enabling Next-Gen LLM Applications. arXiv:2308.08155.
[7] Bumgardner, V. K. C., et al. (2024). Institutional Platform for Secure Self-Service LLM. arXiv:2402.00913.
[8] Bai, Y., et al. (2022). Constitutional AI. arXiv:2212.08073. (Vulnerable to [9-11])
[9] Zhao, J., Chen, K., et al. (2024). SQL Injection Jailbreak. arXiv:2411.01565. (~100% ASR open-source)
[10] Coalson, Z., et al. (2024). PrisonBreak: Jailbreaking LLMs. arXiv:2412.07192. (80-98% ASR)
[11] Rababah, B., et al. (2024). SoK: Prompt Hacking of LLMs. arXiv:2410.13901.
[14] Zhu, J., et al. (2025). MiniScope: Least Privilege Framework. arXiv:2512.11147.
[15] Bühler, C., et al. (2025). Securing AI Agent Execution (AgentBound). arXiv:2510.21236.
[16] Fleming, C., et al. (2025). Uncertainty-Aware Access Control. arXiv:2510.11414.
[12] Asana. (2024). Anatomy of Work Report. 57% coordination time.
[13] OpenClaw, Manus, Character.AI, Replika, Notion, DocSend—landscape positioning.
Full bibliography and extended citations available in the written report.