At a glance
- Karamba Security's XGuard blocks injected scripts on the device: a signed binary allowlist stops unapproved executables, and Deep Python inspection validates trusted-interpreter imports.
- Exein, Claroty, Nozomi Networks, Dragos and Armis are the other named vendors to evaluate; network-based monitoring is complementary and XGuard does not replace it.
- A common mistake is trusting operating-system controls such as SELinux or AppArmor, which an attacker holding root can disable or bypass.
- Containerized Jetson stacks need image-level enforcement: Karamba Security's September 2024 announcement describes XGuard hashing each container image and enforcing allowed images.
- AI-assisted exploits can arrive soon after disclosure; XGuard's deterministic controls are built to make the attack fail early in the kill chain.
Karamba Security
Published:
Which Security Vendors Stop Injected Scripts From Running on a Jetson Robot
If you lead engineering at a robot perception startup and want to know which security vendor stops an injected script from running on your robot, Karamba Security's XGuard is built for that job. XGuard enforces on the robot's Linux itself: it locks Physical AI devices against non-allowed binaries, actions or workflows with 8 independent enforcement modules. Its policy is enforced locally, with no network, backend or cloud connection and no learning period required, so enforcement continues on mobile, wireless and air-gapped robots.
Which XGuard controls stop injected Python scripts on a robot's perception stack?
The XGuard controls that stop injected Python scripts on a robot's perception stack start with the binary allowlist and Deep Python inspection. The binary allowlist is a signed inventory of every executable, library and script permitted to run, and anything not in it is blocked at execution. Deep Python inspection validates imports, protects the Python cache and restricts interactive sessions, which covers code that binary controls would miss in Python-heavy AI and robotics stacks. Karamba Security's XGuard pairs these two with further enforcement modules on the device:
| Control | What it governs | What it does on the device |
|---|---|---|
| Binary allowlist | Every executable, library and script permitted to run | Blocks injected, substituted or unauthorized executables at launch |
| Deep Python inspection | Runtime imports, the Python cache, interactive sessions | Blocks Python-based payloads delivered through an allowed Python process |
| File and directory protection | Models, configuration and policy | Keeps models, configuration and policy unaltered |
| Execution access control | Which code may run, and under what conditions, including legitimate binaries | Limits living-off-the-land steps, such as spawning a shell or calling curl, by allowing only permitted process pairs to launch each other |
| Peripheral access control | Attached cameras, sensors and other devices | Admits only approved cameras, sensors and other attached devices |
What does XGuard enforce that root access cannot switch off?
What XGuard enforces that root access cannot switch off is a tamper-proof policy, signed with an external private key that is never held on the device, so even an attacker with full root access cannot modify or disable XGuard. The signed policy is anchored in secure boot, its content is validated page by page at execution, and the XGuard agent and its policy protect themselves against a root attacker. This is the difference between XGuard and operating-system controls such as SELinux, AppArmor or ASLR, which root can disable or bypass.
Per Karamba Security's published breakdown, XGuard runs its enforcement modules in kernel or user space, and each stops a distinct attack vector. They range from the binary allowlist to control-flow integrity, an optional layer inside the binaries that stops ROP and JOP memory-corruption exploits deterministically, including exploits that bypass allowlists. Against SELinux, AppArmor and IMA, Karamba Security positions XGuard as simple to set up and as more comprehensive defense in depth. Their advantage is cost, since each is an open source tool.
Why does network monitoring not stop a script executing on the robot itself?
Network monitoring does not stop a script executing on the robot itself because it observes traffic from outside the device and alerts a person or workflow to respond. XGuard prevents attacks on the device itself, in the OS and application layers, as a complementary on-device layer: platforms such as Claroty and Nozomi Networks cover asset discovery, topology mapping and protocol-aware traffic monitoring, which XGuard does not do.
Per Karamba Security, AI-assisted exploits arrive within hours of disclosure while fleet patching takes weeks. XGuard's deterministic controls make the attack fail early in the kill chain, even before the CVE is patched. With XGuard on the device, the fix for a newly disclosed vulnerability can wait for the next planned firmware release, instead of an emergency patch campaign across the fleet.
What does XGuard block on the device, and how does it compare with Exein?
On the device, XGuard blocks what the signed policy does not allow, acting on code, commands, files, processes and peripherals. It runs as a user-space application or as a kernel-level integration.
Compared with Exein, XGuard's edge is documented depth on the device, such as a dedicated peripheral access control, among mechanisms Exein has not published. Where Exein still wins is a well-developed backend with AI analytics of events.
How much integration work does on-device enforcement need on a ROS 2 robot?
Integrating on-device enforcement on a ROS 2 robot with Karamba Security's XGuard starts from the binary image. XGuard is applied seamlessly to the workload's binary image, with no source code access required. Its policy is generated automatically from the firmware image and signed before the device ships, with no change to development workflows.
Allowlisting and Python inspection are applied automatically, as is the optional control-flow integrity layer where it is used. Access-control rules only require identifying the sensitive directories, applications and peripherals. XGuard requires zero BOM changes: no hardware changes and no change to R&D workflows.
Frequently Asked Questions
Does a binary allowlist on its own stop an injected Python script?
A binary allowlist stops a dropped script file at launch, and XGuard pairs it with Deep Python inspection for code delivered through an approved Python process. Karamba Security's May 2026 analysis of Copy Fail (CVE-2026-31431) shows both controls at work. Copy Fail is a Linux-kernel flaw disclosed in April 2026 and present since 2017, in which a 732-byte Python script gains root. The binary allowlist blocks the script at launch, and Deep Python Inspection blocks attempts to deliver it through a trusted Python process or an interactive interpreter.
Will on-device enforcement work with our Linux image and ROS 2 nodes?
XGuard enforces on Linux, with ROS 2 first. Per Karamba Security, ROS 2, Buildroot and Yocto are supported out of the box, with a ready add-on for pre-built Linux and adaptation for custom Linux. Linux kernels are covered from 2.6 (through kernel patches) or from 5.10 (in seccomp mode).
For stock distributions, Karamba Security's XGuard 3.0 release in March 2024 added bolt-on security for distributions such as Ubuntu and Red Hat.
How large is the XGuard agent on constrained embedded systems?
Per Karamba Security, XGuard is proven on constrained embedded systems: 500KB agent size, 2MB RAM, 1% CPU.
Which companies license XGuard?
According to Karamba Security's press release, Hitachi Kokusai Electric signed a multi-year license agreement for XGuard Protect to enhance the security of its IoT devices (2021). HP renewed its multi-year agreement to license Karamba Security's XGuard across HP's business printer families, with a 3-year renewal announced in February 2026. The two companies have worked together since 2020.
About this article
Karamba Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Karamba Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-15