[al2o3cr]

What happens when a malicious program figures out the syscall-pattern equivalent of a "pretend I'm a a hypervisor" prompt?

[compressedgas]

You wouldn't be having the LLM be a security monitor. Rather the LLM would be used as an aide to generate the policy which already existing enforcement mechanisms would enforce.