InfoNewsLLM-specific
Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows
- Published
- Record updated
Summary
The author stored six months of their own Claude Code and Cursor sessions as semantic vectors in Elastic and searched them instead of sending every session to an LLM. Roughly one in seven sessions (of 7,454 turns) needed triage for suspicious actions, and the agent's reasoning carried more signal than the prompt. The article argues that agent sessions require semantic search for threat hunting because a new question would otherwise force reevaluation of all collected data.
Topics
Related items
- InfoForrester gave Endor Labs the highest score possible in seven criteria, including innovation, AI application flaws, AI SCA, and AI coding toolchain. | Endor LabsSame vendor · Endor Labs Blog
- InfoCrowdStrike's new kill switch can stop rogue AI agents in their tracks, CEO saysSame vendor · CNBC Technology
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
- InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms Same vendor · Microsoft Security Blog