Why Agent Plugins Are Not a Security Boundary: Inverting Control from In-Process Hooks to a Kernel-Enforced Agent Runtime

Autonomous CLI coding agents -- Claude Code (claude), OpenCode (opencode), Google Antigravity (agy), and Nous Hermes (hermes) -- rely on in-process governance plugins (PreToolUse hooks, additive MCP servers, and prompt rules). We show that treating an in-process plugin as a security boundary violates Anderson's Reference Monitor guarantees of complete mediation, tamper-resistance, and verifiability whenever the agent runs under the developer's UNIX UID. Auditing four production CLI agents reveals six structural bypass classes (V1-V6): workspace escape and unapproved host writes (V1); unconfined socket egress (V2); host credential, Keychain, and environment key theft (V3); hook/config self-tampering (V4); repository code execution during read-only git status/diff via core.fsmonitor (V5); and same-UID self-approval or post-diff TOCTOU swaps (V6). We present Aegis Enforced Runtime (aegis-os run -- <agent>), which inverts control so the OS supervisor confines the unmodified agent inside Linux bubblewrap (--bind-fd) or macOS Seatbelt before execve(). Aegis combines Copy-on-Write shadows with a read-only .git view and .aegis-bin/git shim, read-only config over-mounts, a split-plane L4/L7 egress proxy that injects API keys at the host boundary without TLS MITM, dual-token SessionBroker isolation, and frozen-stage SHA-256 commit pinning. Across 30 deterministic payloads on macOS and Linux plus 54 executed live runs (60-cell matrix) of all four agents, Aegis reduces bypass coverage from 73.3%-93.3% (and 80.0% in OCI/nerdctl devcontainers) to 0.0% and live repository-trap compromises from 100% to 0%, while saving 99.05% of APFS disk allocation on 500 MB packed Git repos, adding +0.221 ms loopback TTFT overhead, and preserving 100% multi-file coding pass rates.