Watching what an AI agent says it's doing isn't enough. Researchers now argue that watching what it actually does at the operating-system level catches attacks that slip past everything else.
The team built a corpus called ACE (Agent Cross-Layer Evidence) that pairs two kinds of security logs for the same AI agent sessions: the usual application-level telemetry (prompts, tool calls, model messages) and kernel-level syscall traces, the record of every low-level request an agent's process makes to the operating system. The dataset covers 4,047 paired sessions, 17 threat models, six delivery-vector families, and 14 of the 25 threat categories in OWASP's list for LLM and agentic systems. Testing four separate detector approaches, the researchers found kernel-level evidence alone was discriminative enough to catch attacks, and combining it with application-layer logs beat either source used on its own. The detectors also generalized to attack types they hadn't seen before and transferred to a different agent runtime.
Most agent-security tools today only watch the layer an attacker can talk to directly: the prompt, the tool manifest, the chat transcript. That's also the layer an attacker can manipulate or route around. If a malicious instruction can smuggle an action past that boundary without leaving a trace in the transcript, the operating system still sees it happen - which is a real blind spot given how much host access agent frameworks now hand out by default.
It's less a breakthrough than an overdue borrowing: syscall monitoring has been standard practice in endpoint security for years, and agent frameworks are only now catching up to that idea.