SecGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems
SecGPT, also referred to as IsolateGPT, is an execution isolation architecture designed to secure LLM-based agentic systems. Its core principle involves isolating the execution of applications and restricting interactions between applications and the system to predefined interfaces, which require explicit user permission. This design mitigates risks such as app compromise, data theft, inadvertent data exposure, and uncontrolled system alterations. SecGPT’s architecture is built upon LlamaIndex and LangChain, two extensible frameworks that support multiple LLMs and applications. The system employs Redis for memory management and is implemented as a personal assistant chatbot, enabling natural language communication with users.
The project was developed by researchers from Washington University in St. Louis and the University of Washington, with its foundational paper accepted for presentation at the NDSS 2025 Symposium. SecGPT is also available as a Llama Pack on LlamaHub, expanding its accessibility and integration capabilities.
The architecture separates the execution of components into isolated processes, referred to as spokes and a hub. These processes are constrained using system utilities such as seccomp (Linux) and setrlimit to limit access to system calls, CPU time, virtual memory, and file sizes. Network requests from applications are further restricted to their root domain (eTLD+1), ensuring controlled and secure interactions.
The system’s isolation mechanisms are enforced through a combination of process separation, resource limits, and network restrictions. This approach ensures that even if one application is compromised, the impact is contained, preventing lateral movement or data exfiltration across the system.
How It Works
SecGPT operates by dividing its architecture into two primary components: the hub and the spokes. The hub acts as the central controller, managing permissions, orchestrating tasks, and coordinating interactions between applications. The spokes represent individual applications or tools, each executing within its own isolated process. Communication between the hub and spokes occurs through well-defined interfaces, ensuring that data and commands are transmitted securely and only when explicitly authorized by the user.
At the process level, spokes are restricted using seccomp and setrlimit to limit system call access and resource consumption. Network requests from spokes are confined to their respective root domains, preventing unauthorized access to external services.
To configure SecGPT, users must set up an environment using Conda, clone the repository, and install dependencies via pip. The system requires an API key for the LLM (defaulting to GPT-4) and configuration files to define enabled functionalities, such as Google Drive or Gmail integration. Authorization for third-party applications is handled separately, with credentials stored securely in designated paths. Advanced users can customize sandbox settings, including system call restrictions and resource limits, by modifying the sandbox configuration file.
Running SecGPT involves executing the main script (secgptmain.py) with optional parameters for user ID and debug mode. For comparative analysis, a baseline non-isolated system, VanillaGPT, is also provided (vanillagptmain.py).
Use Cases
SecGPT addresses four primary security challenges in LLM-based agentic systems: app compromise, data stealing, inadvertent data exposure, and uncontrolled system alteration. These risks are demonstrated through four case studies, each simulating a specific attack scenario. Users can run these case studies (via secgptcasestudies.py and vanillagptcasestudies.py) to observe the differences in behavior between SecGPT and the non-isolated baseline.
The case studies include:
- App Compromise: Demonstrates how SecGPT prevents one application from exploiting vulnerabilities in another, ensuring that a breach in one component does not propagate to the system as a whole.
- Data Stealing: Shows how SecGPT’s isolation mechanisms block unauthorized data access, even when an attacker gains control over a single application.
- Inadvertent Data Exposure: Highlights how natural language ambiguities can lead to unintended data leaks in non-isolated systems, while SecGPT’s controlled interfaces mitigate this risk.
- Uncontrolled System Alteration: Illustrates how SecGPT restricts modifications to system configurations or data, preventing malicious or accidental changes that could disrupt operations.
Each case study provides a practical example of SecGPT’s effectiveness in maintaining security and integrity within complex, multi-application environments.
Key Features & Capabilities
SecGPT’s security model is built on several technical features that distinguish it from traditional LLM-based systems:
- Process Isolation: Applications (spokes) run in separate processes with restricted system call access, preventing unauthorized interactions or privilege escalation.
- Resource Limits: CPU time, memory usage, and file size restrictions are enforced to prevent resource exhaustion attacks or denial-of-service conditions.
- Network Restrictions: Spokes are confined to their root domains (eTLD+1), ensuring that external communications remain within predefined boundaries and cannot be hijacked or redirected.
- Permission-Based Interfaces: All interactions between the hub and spokes require explicit user authorization, reducing the risk of unintended data exposure or system alterations.
- Memory Management with Redis: Long-term memory is stored and managed using Redis, which supports persistence while maintaining isolation between applications.
- Extensible Framework: SecGPT is designed to integrate with LlamaIndex and LangChain, allowing users to incorporate additional LLMs or applications without compromising security.
- Case Study Validation: The system’s effectiveness is validated through empirical case studies that compare its behavior against a non-isolated baseline, providing measurable evidence of its security benefits.
The project’s repository includes detailed documentation on installation, setup, and advanced configurations. Users can contribute to the project by extending its functionality, reporting issues, or proposing new features. The research team behind SecGPT consists of academics from Washington University in St. Louis and the University of Washington, ensuring a rigorous and research-backed approach to security in LLM systems.
The architecture’s modular design allows for customization, such as adding new applications or modifying sandbox policies. For example, integrating Google Drive or Gmail requires enabling the corresponding functionalities in the configuration file and providing the necessary credentials. Troubleshooting guides are available for common issues, such as resolving NameError exceptions in tool libraries or adjusting system call restrictions.
SecGPT’s implementation also includes a VanillaGPT baseline, which serves as a reference for non-isolated LLM systems.