Surrey leads £3.2m project in collaboration with Sheffield and Melbourne to develop provably secure sandbox for AI agents

AI agents are becoming capable of carrying out increasingly complex tasks independently, with recent incidents involving Anthropic and OpenAI highlighting the need for better safeguards that keep them within defined boundaries. The Agentic-seL4 project will explore how AI agents can be safely contained.  

Led by Research and Development Creator Professor Brijesh Dongol from Surrey’s Centre for Cyber Security, the team will build a rigorously verified sandbox that controls what AI agents can access and do, with permissions that can be changed or removed while they are operating. 

For example, an AI agent that has accessed confidential information could be blocked from communicating externally or allowed to do so only after its output has passed through a trusted sanitisation process.  

The system will be backed by formal models and proofs that guarantee the specified policies are always enforced, giving organisations mathematical assurance that sensitive data cannot leak. The project will also develop a proof-of-concept reference design, which will be tested against realistic "agent-escape" scenarios to validate how well these restrictions hold.

Bringing together researchers from the Universities of Surrey, Melbourne, and Sheffield, Agentic-seL4 is one of eight new research projects that have received a share of £22 million through the TA2 Cybersecurity track of ARIA’s Safeguarded AI programme, led by Programme Director Nora Ammann.  

The programme is exploring whether AI-enabled formal methods – mathematical techniques that prove software and hardware behave as specified – can make high-assurance cyber defence practical at a scale previously out of reach. 

###

Notes to editors 

• Professor Brijesh Dongol is available for interview; please contact mediarelations@surrey.ac.uk to arrange 
• ARIA media enquiries: Melissa Bradshaw – melissa.bradshaw@aria.org.uk 
• Find out more about ARIA’s Safeguarded AI programme here