Quantum Cat

Kernel level taint tracking for AI agents enforces below the application, which is normally the strongest place to stand. An agent can be talked into anything. It cannot talk its way past a syscall. Then you choose a granularity and find there are only two. Taint the process, and one read of private data marks everything it does afterwards. Correct, and coarse enough that a long lived agent is permanently tainted within minutes and the review step becomes a button people click through. Taint the descriptor instead and the over marking goes away, along with the agent. Kernel taint propagates by correspondence, these bytes came from those bytes. A model produces nothing that corresponds to its input. It reads a private email into the context window and emits a summary, a tool call argument, a paraphrase. The information left and no tainted descriptor was touched. There is no middle setting. The standard cure for marking too much is to track more finely, and finer tracking is the one thing a language model is structurally immune to, because paraphrase is its native operation rather than an evasion.