Agent security looks past the application layer: kernel syscall traces discriminate on their own, and pairing them with app telemetry beats either view
Synopsis
Agent security detection has worked almost entirely at the application telemetry layer, namely the served tool manifest, the user prompt and the model's messages, yet some threats slip past that boundary. Researchers paired application-level agent telemetry with kernel-level syscall traces to build ACE, a paired-session corpus of 4,047 sessions and 17 threat models spanning six delivery-vector families and 14 of the 25 OWASP LLM and agentic threat categories. Across four detector families, kernel evidence is discriminative on its own, composing it with application-layer evidence generally outperforms either single-layer view, and the result generalizes to unseen attack families and transfers to an alternate agent runtime.
Interpretation
Agent security detection gains a second evidence source: syscall traces recorded by the operating-system kernel, paired with agent application telemetry, carry threat signal the application layer does not show. Existing agent-security benchmarks and defenses operate almost exclusively at the application telemetry layer, the served tool manifest, the user prompt and the model's messages; some threats smuggle malicious instructions and actions past the application boundary and stay invisible there. Across four distinct detector families, kernel evidence is discriminative on its own, and composing it with application-layer evidence generally outperforms either single-layer view, indicating complementary signals.
The basis is a corpus paired by session, keeping application records and kernel traces for the same session so the two layers can be compared directly. Quantifying the value of enhanced telemetry requires aligning both layers to the same session rather than collecting them separately. Agent Cross-Layer Evidence (ACE) holds 4,047 sessions and 17 threat models across six delivery-vector families, covers 14 of the 25 OWASP LLM and agentic threat categories, and is organized into 12 attack mechanics with per-mechanic characterization of where the most discriminative evidence lies.
The paired evidence also carries over to attack families not seen in training and to an alternate agent runtime. Complementary signals that single-layer analyses can miss become explicitly usable under cross-layer composition. Generalization is tested on unseen attack families and transfer on an alternate agent runtime, both reported under the corpus and detector settings above.
Perspective
The demonstrated scope is the ACE corpus of 4,047 sessions and 17 threat models, where kernel evidence is discriminative on its own across four detector families and cross-layer composition generally outperforms either single layer; generalization to unseen attack families and transfer to an alternate agent runtime are reported under the same setting. The corpus spans six delivery-vector families and 14 of the 25 OWASP LLM and agentic threat categories, organized into 12 attack mechanics. Intended readers are engineers and security researchers designing agent runtime monitoring and detection.
The corpus covers 14 of the 25 OWASP LLM and agentic threat categories, leaving the rest out. Generalization and transfer results address unseen attack families and one alternate agent runtime respectively, without stating behavior in broader runtimes or deployment settings. Detector comparison is limited to four families.