LATIDIA · Ciberseguridad

AgentLoupe: Etiquetas causales semánticas residentes en el núcleo para la observabilidad del agente de IA

arXiv: 2610.23233v1Announce Type: new Resumen: Los agentes de IA traducen las intenciones del usuario en acciones del sistema a través de invocaciones de herramientas. Atribuir con precisión estas acciones a sus interacciones LLM de origen es esencial para Secur

La noticia

arXiv:2610.23233v1 Announce Type: new Abstract: AI agents translate user intents into system actions via tool invocations. Accurately attributing these actions to their originating LLM interactions is essential for security auditing, yet existing methods, such as AgentSight, fail for delayed execution and cross-process-lineage behaviors. We present AgentLoupe, an application-transparent eBPF-based observability tool. The core insight of AgentLoupe is to embed causal identity into kernel resources.AgentLoupe employs eBPF to capture TLS plaintext to interpret LLM interactions, and assigns each a kernel-resident semantic label.It maintains labels in eBPF maps, then propagates this label across processes and threads, associates it with kernel resources such as files and sockets. When a persistent resource carries context