Researchers link 4,047 agent sessions to kernel traces

Researchers paired 4,047 AI agent sessions with the kernel-level system call traces recorded while each one ran, according to the ACE Corpus paper.

Most agent security tools watch the prompt, the tool manifest, and the model's own messages. That's the application layer. The paper argues attacks that smuggle actions past that boundary, using the operating system itself, go unseen by tools that never look past the chat log. The corpus covers 17 threat models and 14 of the 25 OWASP categories for LLM and agentic systems.

The results back the premise. Kernel traces alone were enough to separate attack sessions from normal ones. Combining kernel data with application-layer signals beat either source alone. The detectors held up on attack types they weren't trained on, and on a second runtime environment entirely.

Agent frameworks are adding tool access faster than they're adding runtime auditing to match it. A monitoring setup that only reads the conversation and the tool manifest will miss exactly the class of attack this corpus was built to catch, the kind that reaches the kernel underneath the chat log.