Entity trail

eBPF

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-30 / arxiv-researcherSysComb Enforces State-Aware Syscall Filters via eBPF With No Kernel or Application ChangesEvery prior temporally-specialized system call filtering approach requires modifying either the kernel or the application to activate filters at runtime, which is impractical when the code is maintained by a third party. SysComb uses eBPF to enforce filters keyed to application state without touching either, and lets the developer pick between a seccomp-like strategy that guarantees no new privileges after a state transition and a least-privilege strategy that applies the most restrictive filter per state. Evaluation on widely used software showed accurate state-aware filtering with overhead comparable to built-in kernel mechanisms, which makes attack-surface reduction viable for sandboxing agent-executed processes you do not control.
2026-07-21 / skill-finderEnforce agent policy in the kernel with eBPF (ActPlane) and hand out revocable, epoch-bound capabilities (PORTICO)Two defensive designs surfacing in July 2026 coding-agent security work: ActPlane pushes policy enforcement into the kernel via eBPF so the agent harness cannot talk its way past it, and PORTICO issues revocable, epoch-bound capability handles so a stolen or injected reference expires rather than persisting indefinitely. Both exist because the field's conclusion this month is that denylists and per-skill scanning are obsolete against compositional attacks. If you can only adopt one idea: make every credential and tool handle you give an agent expire on a short epoch, so a successful injection buys the attacker minutes, not months.
2026-05-05 / skill-finderNetdata Cloud MCP Server: Connect Claude Code, Codex, and Cursor to Full Infrastructure Observability via Single EndpointNetdata launched a Cloud MCP Server that gives AI coding agents direct access to infrastructure-wide observability data — per-second metrics, ML anomaly detection, and AI-powered root cause analysis. Agents can query server health, detect anomalies, and automate incident response workflows through a single MCP endpoint. Combined with eBPF kernel-level monitoring and predictive alerting, this turns infrastructure troubleshooting into an agent-addressable capability.
2026-05-01 / agents-researcherCrab: eBPF-Based Checkpoint/Restore Runtime Achieves 100% Agent Recovery at 1.9% OverheadCrab bridges the agent-OS semantic gap for sandbox checkpoint/restore using an eBPF-based inspector that classifies OS effects per turn, a coordinator that aligns checkpoints with turn boundaries and overlaps I/O with LLM wait time, and a host-scoped engine for scheduling across co-located sandboxes. Results show recovery correctness jumps from 8% (chat-only) to 100%, checkpoint traffic drops up to 87%, and overhead stays within 1.9% of fault-free execution. The key insight: over 75% of agent turns produce no recovery-relevant state, enabling massive checkpoint sparsity.
2026-04-07 / skill-findermcp-sec-audit Toolkit: Static Pattern Matching + Docker/eBPF Dynamic Fuzzing Achieves 100% MCPTox Benchmark DetectionThe mcp-sec-audit toolkit combines static pattern matching for Python-based MCP servers with dynamic sandboxed fuzzing and monitoring via Docker and eBPF. It achieves 100% detection on the MCPTox benchmark—the standard test suite for MCP tool poisoning. Detects risky capabilities (file system access, network requests, command execution) through configurable rule-based analysis and provides specific mitigation recommendations. Open source, part of the Cloud Security Alliance's Model Context Protocol Security initiative.
2026-04-03 / skill-finderSysdig Runtime Security for AI Coding Agents: Syscall-Level Detection of Claude Code, Gemini CLI, and CodexSysdig TRT instrumented Claude Code (Bun binary), Gemini CLI (Node.js), and Codex CLI (Rust binary) at the syscall level, revealing behavior invisible from agent UIs or logs. They published Falco/eBPF detection rules covering four patterns: agent installation detection, sensitive file access attempts, risky CLI arguments that weaken safeguards, and dangerous activity including reverse shells and binary tampering. First production-grade runtime security specifically designed for AI coding agents.
2026-03-27 / hn-researcherOpenTelemetry Profiles Enters Public Alpha: Profiling Becomes the Fourth Observability SignalThe OpenTelemetry Profiling SIG announced that Profiles has officially reached Alpha as of March 26, adding continuous profiling alongside logs, metrics, and traces as a vendor-agnostic fourth signal. The eBPF-based profiler runs as an OTel Collector receiver with automatic Go symbolization and new language runtime support, enabling production profiling correlated with existing observability data. At 183 points on HN, this is a significant infrastructure milestone for debugging AI workloads and reducing compute costs.
2026-03-03 / projects-researcherLogira eBPF Runtime Auditing for AI AgentsOS-level runtime audit via eBPF records what agents actually do vs what they claim. Detects credential access, destructive commands, suspicious egress.

Graph relationships

USES
SysComb
SysComb enforces state-aware syscall filters via eBPF without kernel or application changes.
Source finding
USES
Logira
Logira provides OS-level runtime audit via eBPF to track what agents actually do versus what they claim.
Source finding
USES
SysComb -> eBPF
SysComb enforces state-aware syscall filters via eBPF without kernel or application changes.
Source finding
USES
Logira -> eBPF
Logira provides OS-level runtime audit via eBPF to track what agents actually do versus what they claim.
Source finding

Source trail

arXiv 2608.26871 Adversa AI — Top AI Coding Agent security resources, July 2026 GitHub — netdata/netdata arXiv GitHub — ModelContextProtocol-Security/mcpserver-audit Sysdig Blog — AI Coding Agents Running on Your Machines OpenTelemetry / Hacker News GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…