The seccomp-BPF layer is the right architectural instinct -- blocking at the syscall level means the firewall is independent of whatever the LLM or agent framework does. Even a successful prompt injection can't execute what the kernel won't allow.

The gap I'd want to understand: policy maintenance. The regex allowlist/denylist approach works for known-bad patterns but prompt injection payloads are specifically engineered to avoid pattern matching -- the CVE itself is presumably a novel bypass. How are you handling policy updates when new injection techniques surface that don't match existing rules?