{"data":{"id":"df9e05b8-01dd-495b-8309-0506181f661c","title":"Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows","summary":"The author stored six months of their own Claude Code and Cursor sessions as semantic vectors in Elastic and searched them instead of sending every session to an LLM. Roughly one in seven sessions (of 7,454 turns) needed triage for suspicious actions, and the agent's reasoning carried more signal than the prompt. The article argues that agent sessions require semantic search for threat hunting because a new question would otherwise force reevaluation of all collected data.","solution":"N/A -- no mitigation discussed in source.","labels":["research","security"],"sourceUrl":"https://www.elastic.co/security-labs/blog/ai-agent-session-monitoring-embedding-models","publishedAt":"2026-11-04T00:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":[],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","Cursor","Uber Agentic AI Detection and Response"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-04T00:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}