ARK multiplexes agents inside a shared process. Isolation is logical (Reset, namespaces, capability roots, policy), not a full hypervisor.

Please open a private security advisory or email maintainers if you discover:

• Cross-agent data leakage after Reset
• Capability path escape outside workspace root
• Shell/exec reachable from ToolEngine
• WAL/state confusion enabling privilege mix-up

1. One worker per trust domain when agents are mutually hostile.
2. Path-restrict workspace roots per tenant.
3. Keep policy deny-list for shell; enable seccomp on Linux when available.
4. Monitor tainted_count and treat growth as incident signal.
5. Do not run untrusted agent JS with host bindings until a reviewed bridge exists.