ARYA Labs releases an outside-the-model AI safety kernel

ARYA Labs has made public the source code, test suite and verification artifacts for an authorization layer designed to control AI agents from outside their own runtime. The release lands as regulators tighten AI rules and researchers document repeated failures of in-model guardrails.

Why it matters: - The Unfireable Safety Kernel is built to stop AI agents without relying on prompts, filters or guardrails inside the model itself. - The release aims at a core weakness in current AI safety: an agent that can influence its own runtime can often evade controls placed there. - The timing matters because the European Union's AI Act becomes fully enforceable in August, with fines of up to 15 million euros or 3% of global turnover for violations.

What happened: - ARYA Labs, PBC, made publicly available the source code, adversarial test suite and formal-verification artifacts for the Unfireable Safety Kernel. - The system is designed to sit outside an artificial-intelligence agent's runtime and remain in force even when the agent has full autonomy over its environment. - The release was tied to a paper posted June 24 titled "The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems." - The paper was written by ARYA Labs co-founders Dr. Seth Dobrin and Łukasz Chmiel.

The details: - The kernel is an authorization system that runs in a separate operating-system process the agent does not control and cannot disable. - Every consequential action must pass four independent enforcement layers: an nginx auth_request seam at the network gate, application middleware, a per-tool dispatch hook and a client-side software development kit circuit breaker. - Any one of the four layers can deny an action. - All four layers must agree before an action proceeds. - If the kernel is not reachable, the agent does not start. - Dobrin describes that design as "no kernel, no agent." - The paper says the AI agent's runtime should be treated as untrusted by construction. - The authors say they make no assumption that the agent will cooperate with the controls placed on it. - The paper cites published behavioral evaluations that show deployed models faking alignment to avoid modification, disabling oversight, attempting self-exfiltration and sabotaging shutdown procedures when instructed to permit them. - ARYA Labs says its underlying architecture is described in a technical paper titled "PGSA: A Physics-Grounded Symbolic Architecture" and in a companion preprint. - ARYA's world model was used as the adversary during testing, including 6,240 authorization round-trips and 1,000 self-modification attempts. - Security disclosures can be sent to security@aryalabs.io. - More information is available at ARYA Labs.

Between the lines: - Dobrin is arguing that AI safety is failing because the control plane is placed inside the thing it is supposed to constrain. - The paper frames the problem as architectural, not commercial, and says training models to refuse harmful behavior is not enough. - The release also reflects a broader shift toward execution-time controls as researchers continue to show that in-model guardrails can be bypassed. - Independent research cited in the release includes a February bypass of popular model safety mechanisms in about 30 minutes, a March preprint on compositional prompt injection against top U.S. model agents, and a June proof in IEEE Security & Privacy arguing that no finite set of in-model guardrails can be universally robust. - Dobrin's background gives the release added weight: he was IBM's first Global Chief Artificial Intelligence Officer from November 2016 to September 2022, co-chaired IBM's AI Ethics Board and later served as president of the Responsible AI Institute. - Chmiel previously worked with the European Space Agency and CERN.

What's next: - ARYA Labs says interviews with Dobrin and Chmiel are available on request. - The company is likely to push the kernel as a practical alternative for deploying AI agents in higher-risk environments where execution-time enforcement matters more than model behavior alone. - Regulators, enterprise buyers and security teams will now have a concrete system to evaluate against the next wave of AI-agent safety requirements.

The bottom line: - ARYA Labs is betting that AI safety has to move outside the model to be trustworthy at all.