Sysdig Runtime Security for AI Coding Agents: Syscall-Level Detection of Claude Code, Gemini CLI, and Codex
Sysdig Blog·high signal
Sysdig TRT instrumented Claude Code (Bun binary), Gemini CLI (Node.js), and Codex CLI (Rust binary) at the syscall level, revealing behavior invisible from agent UIs or logs. They published Falco/eBPF detection rules covering four patterns: agent installation detection, sensitive file access attempts, risky CLI arguments that weaken safeguards, and dangerous activity including reverse shells and binary tampering. First production-grade runtime security specifically designed for AI coding agents.