InfoResearchPreprintLLM-specific
AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability
- Published
- Record updated
Summary
AgentLoupe is an application-transparent eBPF-based observability tool that attributes AI agent tool invocations to their originating LLM interactions. It captures TLS plaintext to interpret LLM interactions, assigns each a kernel-resident semantic label stored in eBPF maps, and propagates that label across processes, threads, files and sockets. The authors report average observation overhead below 8% and case studies tracing cross-lineage persistent attacks back to their originating LLM interactions.
Topics
Related items
- MediumCVE-2026-111991: WongKinYiu yolov9 code injection via ONNX Metadata HandlerSimilar attack · NVD/CVE Database
- LowWhat are self-replicating ‘AI worms’, and why is Anthropic worried about them?Similar attack · The Guardian Technology
- MediumCVE-2026-112047: OneUptime incorrect authorization in cluster actions by project membersSimilar attack · NVD/CVE Database
- HighCVE-2026-96620: Claude Agent SDK argument injection via resume option enabling command executionSimilar attack · NVD/CVE Database
- HighCVE-2026-59970: Tandoor Recipes SSRF through AI provider URL in AI actionsSimilar attack · NVD/CVE Database