Loading story…
Security practitioners are increasingly advocating syscall-level visibility for AI agents and other untrusted workloads because application-layer logs and telemetry can be manipulated or suppressed after compromise. One proposal argues that prompt-injected agents can be instructed to “act quietly,” making orchestrator and in-app observability unreliable; by contrast, real-world actions still manifest as kernel syscalls such as open(), connect(), and execve(). The recommended control point is eBPF-based tracing (optionally scoped with cgroups) to detect anomalous behaviors like unexpected outbound connections, access to credential files (e.g., open() on sensitive paths), or suspicious process execution (e.g., spawning bash/curl), enabling alerting independent of what the agent reports.
Related research on Python supply-chain risk reports that a large share of PyPI malware executes at install time (e.g., via setup.py or post-install hooks), creating a monitoring gap in many CI pipelines. A proof-of-concept sandbox, KEIP, uses BPF LSM hooks to monitor the pip process tree and enforce an install-time network policy by whitelisting connect() destinations (e.g., only allowing traffic to package repositories), with the author claiming it blocked active C2/exfiltration attempts across tested samples on kernels 5.8+ with BTF. Together, the work highlights a common defensive theme: kernel-level eBPF/LSM controls can provide tamper-resistant observability and policy enforcement for both AI-agent runtimes and package installation workflows where user-space controls may be bypassed or start too late.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
A March 2026 analysis examined Anthropic’s Claude Code Auto Mode as a response to failing per-action human approvals, citing data that users approve 93% of prompts and that the model-based safeguard still misses 17% of dangerous overeager actions. The write-up argued that enterprises should not treat human-in-the-loop approval as a primary control and should pair probabilistic monitoring with deterministic sandboxing and hard boundaries.
Sysdig Threat Research Team analyzed AI coding agents including Claude Code, Gemini CLI, and Codex CLI on developer endpoints and CI/CD systems, arguing that kernel- or syscall-level monitoring is needed because the agents repeatedly spawn shells, read files, and make network connections with user privileges. The team said it built Falco and Sysdig behavioral detections for agent installation, unauthorized access to agent config directories, sensitive file reads, and unsafe launch-flag bypasses.
An analysis of 12 production multi-agent deployments found that 34% of failures in OpenAI-compatible environments were caused by contract boundary violations, including unauthorized tool use, budget overruns, and invalid parameters. The study contrasted this with a kernel-enforced tool-allowlist deployment that recorded zero such violations during the test window.
A separate post argued that prompt-injected AI agents can tamper with or suppress their own logs, making application-layer observability unreliable, and proposed kernel-level syscall monitoring with eBPF and cgroup filtering instead. The author said they built and published an open-source tool called Azazel to validate this approach for detecting behaviors such as exfiltration, credential access, and shell spawning.
The author released KEIP as an open-source proof of concept for install-time enforcement during pip installs on Linux. KEIP uses BPF LSM hooks to restrict outbound network connections from the pip process tree to PyPI only, and the author reported it blocked all active C2 and exfiltration attempts observed in the tested subset.
An analysis of the QUT-DV25 malware dataset, covering about 14,000 malicious Python packages, found that many samples execute payloads during installation via setup.py or post-install scripts, allowing them to evade typical CI and runtime defenses. The write-up states that 56% of the malware in the dataset runs at install time.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
resilientcyber.io
Open sourcesysdig.com
Open sourcewebflow.sysdig.com
Open sourcethecolony.cc
Open sourcereddit.com
Open sourcenews.ycombinator.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security research highlighted a continued shift in attacker tradecraft toward **Linux cloud and container environments**, with stealth-focused malware increasingly abusing modern kernel capabilities. Elastic Security Labs documented the evolution of Linux rootkits from userland hijacking and LKM implants to newer generations that leverage **eBPF** and **io_uring** for stealth and evasion, citing examples including **TripleCross**, **Boopkit**, and **RingReaper**. Separately, reporting on **VoidLink** described a cloud-native malware framework designed to operate inside Linux workloads, detect whether it is running in major cloud providers and in **Docker/Kubernetes**, and adapt its behavior to remain persistent while harvesting sensitive material such as cloud metadata and credentials. Operationally, the same kernel features and observability gaps being leveraged by attackers are also driving defensive tooling improvements. Trail of Bits released *mquire*, an open-source Linux memory forensics tool intended to reduce dependency on external debug symbols by extracting structure and symbol information directly from memory using **BPF Type Format (BTF)** and **Kallsyms** (e.g., `/proc/kallsyms`-style data), then exposing findings through an interactive **SQL** query interface. While *mquire* is not tied to a single named campaign, it is directly relevant to investigating advanced Linux threats (including kernel-level implants and stealthy cloud malware) by enabling more reliable post-compromise analysis of Linux memory dumps across kernel versions.
Jul 12, 2026
Security researchers and industry reporting describe **prompt injection—especially web-based indirect prompt injection (IDPI)**—as an increasingly practical technique for compromising or manipulating **LLM-powered agents** embedded in browsers and automated content pipelines. Palo Alto Networks Unit 42 reported in-the-wild IDPI activity where malicious instructions are hidden in web content that an agent later ingests, with observed objectives including **AI-based ad review evasion** and **SEO manipulation** that promotes phishing infrastructure. Separately, Zenity Labs detailed a now-patched issue in Perplexity’s *Comet* AI browser where attackers could embed instructions in a **calendar invite** to coerce the agent into accessing `file://` resources and potentially pivoting into sensitive data such as an unlocked **1Password** extension vault, illustrating how agentic tooling can bypass traditional browser-origin assumptions. Threat reporting also shows adversaries operationalizing AI to scale exploitation. Team Cymru linked an AI-assisted Fortinet FortiGate targeting campaign (previously reported by Amazon Threat Intelligence as compromising **600+ devices across 55 countries** using services like **Claude** and **DeepSeek**) to use of **CyberStrikeAI**, an open-source Go-based platform that integrates 100+ security tools and was observed from multiple IPs (primarily hosted in China/Singapore/Hong Kong, with additional infrastructure elsewhere). Multiple commentaries and briefings emphasize that conventional “filter the prompt” defenses are insufficient because LLMs lack a native separation between instructions and data; they call for **defense-in-depth** around AI pipelines, including least-privilege agent permissions, auditable tool use, and stronger identity/workload controls as agent deployments multiply. Several items in the set are unrelated (geopolitical cyber activity, workforce/culture pieces, jobs, and product/market commentary) and do not materially inform the prompt-injection/agent-abuse story.
Sep 3, 2026
Autonomous AI “agents” that can execute shell commands, fetch URLs, and write files on developer endpoints are rapidly expanding the attack surface by blurring the line between *data and code* and by effectively acting as a high-privilege “insider” on a user’s machine. Reporting highlighted **OpenClaw** (formerly *ClawdBot/Moltbot*) as a fast-adopted open-source agent designed to run locally and proactively take actions on a user’s behalf, often requiring broad access to files, online services, and communications tools—conditions that increase the impact of prompt-injection, malicious instructions, and unsafe automation. In response to these risks, the open-source project **Sage** introduced an “Agent Detection & Response (ADR)” interception layer that hooks into supported agent platforms (including **Claude Code**, **Cursor/VS Code**, and **OpenClaw**) to inspect and gate tool calls such as Bash commands, URL retrieval, and file writes before execution. Sage combines cloud reputation checks (malware/phishing/scam detection), local heuristics using YAML-based threat definitions, and supply-chain checks for `npm`/`PyPI` packages (e.g., registry existence, reputation, and age analysis), plus plugin scanning at session start; it also emphasizes a privacy model that keeps commands and file contents local while optionally sharing URL/package hashes with Gen Digital reputation services. Related research cited alongside the release reported **18,000+ internet-exposed OpenClaw instances** and that **~15% of observed skills contained malicious instructions**, underscoring the need for endpoint-style controls tailored to agent-driven actions.
Jun 29, 2026