VIDRAFT ViKernel: Reading a Document Isn’t the Same as Having Permission to Act
How 661 self-reported tests reframe the AI agent authorization debate
TL;DR: VIDRAFT, a Korean Pre-AGI AI startup, publicly demonstrated its ViKernel technology and shared results from 661 self-reported tests conducted across four public models using simulated tools and synthetic data, with no unsolicited external transmissions observed. The company’s design separates the ability to read a document from the authority to execute instructions found within it, targeting a core vulnerability in AI agent systems: prompt injection via external content. Coverage of the announcement appeared in ZDNet Korea and AI Times on November 3, 2026, and was subsequently analyzed by Chinese portal NetEase (网易) on November 4, 2026.
VIDRAFT, the Korean Pre-AGI AI startup, is drawing international attention after Chinese media outlet NetEase (网易) published a detailed analysis of the company’s ViKernel technology on November 4, 2026 — spotlighting a distinction that sits at the heart of modern AI agent safety: the gap between what an AI assistant can read and what it is actually authorized to do.
What VIDRAFT Announced
The core premise behind ViKernel, as described in VIDRAFT’s own technical disclosures and covered by ZDNet Korea and AI Times on November 3, 2026, is deceptively straightforward: a sentence appearing inside a document does not constitute a command the AI is permitted to execute. This matters because AI agents that call external tools — sending emails, querying APIs, triggering workflows — must make active decisions about which proposed actions fall within the scope of a user’s original request and which do not.
ViKernel’s publicly described design layers a security operating system and CPU-level operations on top of a base model’s existing weights, leaving those weights unmodified. The architecture also incorporates signed authorization for resuming execution and maintains an audit log — mechanisms intended to ensure that text encountered during a task cannot silently elevate its own permissions and reshape what the agent is allowed to do.
The publicly documented demonstration interface, observed at version Demo v0.4, displayed a configuration identified as Spark API with ViKernel gating and a CPU reference path. NetEase’s analyst was careful to note that this visible configuration describes how the system is set up, not that execution verification was completed inside the underlying model weights themselves.
The Policy Engine at the center of the demo handled two illustrative, hand-selected actions using synthetic tools and fictional data. It approved a simulated weather lookup request for Busan under one policy rule, and it blocked a simulated email directed to an example undeliverable address under a separate rule. No real email was sent. NetEase’s coverage emphasized this point directly: these were two curated examples designed to show the conceptual separation between a proposed action and the authorization to carry it out — not a live prompt-injection stress test.
VIDRAFT also reported a 21x comparison figure relating to the policy decision stage specifically. NetEase’s analyst flagged that this number does not describe the speed of an entire agent task or a whole computer system; reading input, generating a response, evaluating whether an action is permitted, and executing a tool are four distinct stages, and the figure applies to only one of them.
On the testing side, VIDRAFT self-reported 661 tests run across four public models with simulated tools and synthetic data, during which no unsolicited external transmissions were recorded. NetEase was explicit that these are company-reported figures under those specific conditions — not third-party certification, not real-world deployments, and not a customer count.
Why It Matters
The authorization gap ViKernel targets is not an edge case. As AI agents take on more complex, multi-step tasks — browsing the web, reading uploaded files, processing emails, interacting with APIs — they encounter content that was not written by the user and may not reflect the user’s intent. Prompt injection exploits exactly this ambiguity, attempting to smuggle instructions into an agent’s context by disguising external content as legitimate commands.
Get ArXiv’s stories in your inbox
Join Medium for free to get updates from this writer.
What VIDRAFT is surfacing, and what NetEase’s analysis underscores, is that “can the model understand this text?” and “should the model act on this text?” are fundamentally different questions requiring different enforcement mechanisms. A fluent, capable language model can read and summarize a document that contains malicious instructions without executing those instructions — but only if the system around it draws and enforces that boundary explicitly.
The distinction between VIDRAFT’s live AgentGuard path and its replay path, as noted in the publicly available README, also matters for how observers interpret demonstrations: replay mode clarifies a workflow’s structure, while a live run reflects what actually happens during a given request. The NetEase coverage argues that conflating the two leads to overstating what any single screenshot proves.
Key Takeaways
- VIDRAFT publicly demonstrated ViKernel, a technology designed to separate document comprehension from action authorization in AI agents, with coverage from ZDNet Korea, AI Times, and Chinese portal NetEase.
- The company self-reported 661 tests across four public models using simulated tools and synthetic data, observing no unsolicited external transmissions — results that are company-reported, not independently certified.
- A reported 21x comparison figure applies specifically to the policy decision stage of agent processing, not to overall agent task speed or system-wide performance.
- The Demo v0.4 interface showed two hand-selected synthetic examples approving and blocking simulated actions; no real external requests were made during the demonstration.
- NetEase’s analyst distinguished between the visible API configuration in the demo and verified internal execution, urging readers to evaluate AI agent tools by testing concrete, outcome-defined tasks rather than relying on demonstration screenshots alone.
Frequently Asked Questions
Q: What is VIDRAFT’s ViKernel, and what problem does it address? A: ViKernel is an AI agent security technology developed by Korean startup VIDRAFT. It is designed to enforce a boundary between content an AI reads and actions the AI is authorized to execute, directly targeting the prompt-injection vulnerability where external document text could otherwise be treated as a legitimate user command.
Q: What did the 661 tests that VIDRAFT reported actually measure? A: VIDRAFT self-reported 661 tests conducted across four public models using simulated tools and fictional data, tracking whether any unsolicited external transmissions occurred. The company observed none, though these are internal figures under controlled conditions and do not represent third-party validation or real-world deployment results.
Q: Does the 21x performance figure mean AI agents using ViKernel run 21 times faster overall? A: No. The 21x comparison figure reported by VIDRAFT applies specifically to the policy decision stage — the step where the system evaluates whether a proposed action is permitted. It does not describe the speed of a complete agent task, which involves multiple distinct stages including input processing, response generation, and tool execution.
Source: 넷이즈 网易 (중국) (2026–11–04) — original article
