# Kernel-Level Syscall Trace Analysis

Agent security detection has worked almost entirely at the application telemetry layer, namely the served tool manifest, the user prompt and the model's messages, yet some threats slip past that boundary. Researchers paired application-level agent telemetry with kernel-level syscall traces to build ACE, a paired-session corpus of 4,047 sessions and 17 threat models spanning six delivery-vector families and 14 of the 25 OWASP LLM and agentic threat categories. Across four detector families, kernel evidence is discriminative on its own, composing it with application-layer evidence generally outperforms either single-layer view, and the result generalizes to unseen attack families and transfers to an alternate agent runtime.

Agent security detection has worked almost entirely at the application telemetry layer, namely the served tool manifest, the user prompt and the model's messages, yet some threats slip past that boundary. Researchers paired application-level agent telemetry with kernel-level syscall traces to build ACE, a paired-session corpus of 4,047 sessions and 17 threat models spanning six delivery-vector families and 14 of the 25 OWASP LLM and agentic threat categories. Across four detector families, kernel evidence is discriminative on its own, composing it with application-layer evidence generally outperforms either single-layer view, and the result generalizes to unseen attack families and transfers to an alternate agent runtime.