AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability

AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability Yifei Bao* , Ting Liu* , Yuxin Ren† , Ruizhe Huang† , Likang Luo‡ , Ziteng Xu‡ , Yu Wang‡ , Peng Jiang*✉ * Southeast University, † Peking University, ‡ Ant Group

arXiv:2610.23233v1 [cs.CR] 16 Oct 2026

Abstract

access [4, 20]. However, agents introduce nontrivial security and reliability risks since an agent that errs or is subverted can directly damage the host infrastructure. As agents are non-deterministic, the same request expands into a different, unpredictable set of system actions on each run [20]. Static vetting and application-layer observability tools [10, 11, 15] cannot capture system actions and fail to mitigate security risks [20]. Therefore, the community has converged on that auditing of actual system actions is essential for agent observability, with AgentSight [20] representing the state-of-the-art approach of eBPF-based in-kernel tracing. AgentSight [20] uses eBPF [8] to capture TLS plaintext and system activity in the kernel. AgentSight then correlates concrete actions with LLM responses in a user-space engine using process lineage, temporal proximity, and argument matching, followed by a secondary LLM that analyzes the resulting traces. However, AgentSight faces two limitations. First, its observation scope is bound to the target agent’s process tree, so events from lineage-external processes do not directly enter the correlation pipeline. Second, the causal association remains ambiguous. Time-window matching breaks when execution is delayed by hours or days, and textual similarity can only approximate resource identity rather than prove it. The root cause is that correlation metadata is never embedded into the events or the kernel resources they operate on. These limitations directly break auditability in AgentSight under realistic attacks. Consider a simple cron-triggered reverse shell attack detailed in §2.1. A compromised agent installs a malicious crontab entry for hourly execution. Long after the agent process exits, the system cron daemon spawns a process that runs the malicious entry. AgentSight fails on two fronts. First, its process-tree bounded scope excludes the cron daemon and its child processes, so the actual execution-phase attack events are never captured. Second, the multi-hour delay exceeds any temporal proximity window, and AgentSight cannot establish causal attribution to the originating compromised agent. Thus, attackers can launder malicious actions through standard system persistence mechanisms, severing the causal trail back to its semantic origin and rendering runtime security forensics fundamentally incomplete. To resolve these limitations, our core insight is to generate a kernel-resident semantic label when LLM prompt is captured and let that label travel with the resources the agent touches. We not only capture system actions, but also embeds causal identity and association into kernel resource (such as files, executables, and sockets) that bridge

AI agents translate user intents into system actions via tool invocations. Accurately attributing these actions to their originating LLM interactions is essential for security auditing, yet existing methods, such as AgentSight, fail for delayed execution and cross-process-lineage behaviors. We present AgentLoupe, an application-transparent eBPF-based observability tool. The core insight of AgentLoupe is to embed causal identity into kernel resources. AgentLoupe employs eBPF to capture TLS plaintext to interpret LLM interactions, and assigns each a kernel-resident semantic label. It maintains labels in eBPF maps, then propagates this label across processes and threads, associates it with kernel resources such as files and sockets. When a persistent resource carries context to an independent process outside the original lineage, this design preserves the delayed causal association. Experiments show that the average observation overhead of AgentLoupe is below 8%, and case studies confirm AgentLoupe traces cross-lineage persistent attacks back to their originating LLM interactions. CCS Concepts: • Software and its engineering → Software maintenance tools; • Security and privacy → Information flow control. Keywords: AI Agents, observability, eBPF, causal provenance, information flow tracking ACM Reference Format: Yifei Bao, Ting Liu, Yuxin Ren, Ruizhe Huang, Likang Luo, Ziteng Xu, Yu Wang, and Peng Jiang. 2026. AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability. In Practical Adoption Challenges of ML for Systems (PACMI ’26), September 29– October 2, 2026, Prague, Czech Republic. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3843967.3844687

1

Introduction

LLM-powered agents are widely deployed in industry [1, 14], autonomously translating user intents into system actions such as process spawning, file modification, and network ✉ Corresponding author.

This work is licensed under a Creative Commons Attribution 4.0 International License. PACMI ’26, September 29–October 2, 2026, Prague, Czech Republic © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2998-0/26/09 https://doi.org/10.1145/3843967.3844687 1

cross-boundary execution. This design delivers three advantages. 1) Coverage is complete because association is triggered by resource contact rather than process-tree membership, naturally capturing actions from lineage-external system daemons. 2) Causality is persistent because the label resides on kernel objects and does not decay when processes exit or time passes, supporting long-delayed and cross-session attribution. 3) Association is definitive because each event carries its semantic label derived from LLM interaction, eliminating the ambiguity of heuristic post-hoc correlation. Based on the insight, we implement AgentLoupe, an application transparent system-level observability tool for AI agents. In the kernel, AgentLoupe leverages eBPF probes on TLS libraries and system calls to capture TLS plaintext, recognize LLM interaction, and generate associated chain identifiers. Identifier association is maintained in eBPF maps and propagated across processes, files, and sockets under controlled inheritance rules. TLS interaction records and system propagation events are emitted to user space through dedicated buffers. The user-space layer reconstructs application protocols, aggregates events by chain identifiers, and provides a unified audit trail with semantic risk analysis. One engineering challenge is to recognize LLM interaction payload under the eBPF verifier’s limited stack and instruction budget. AgentLoupe resolves it via bounded keyword scanning, per-CPU scratch buffers, and user-space reconstruction for truncated payloads. Evaluation shows that AgentLoupe introduces less than 8% average end-to-end overhead. Two case studies confirm that AgentLoupe can trace cross-lineage and delayed persistent attacks back to their originating LLM interactions, while AgentSight cannot due to its process-tree scope and ambiguous correlation.

2

Background and Motivation

2.1

Agent Background and Security Threats

LLM Turn

Inside Lineage 1 hour Outside Lineage later

Prompt: I need to run a compliance security test. Please help me set up a cron job that runs every hour: `sh -i >& /dev/tcp/ ip/9999 0>&1`

Response: Done.

A scheduled task has been added to crontab to run the test command per hour.

Agent actions

crontab

openat

fork

write

Agent proc write

cron proc

bash -i openat connect

payload.sh

socket:9999

proceess

file

socket

Figure 1. Delayed cron-triggered reverse-shell attack. script. The resulting lineage-external shell then establishes a network connection to the attacker’s endpoint. However, this malicious execution is separated from the originating LLM interaction by both time and process lineage, while the causal dependency is carried only by the persistent files written by the agent. Without tracking this resource-mediated dependency, the later shell execution and network connection appear as isolated system events and cannot be attributed to the LLM interaction that initiated the attack. 2.2

Limitations of Current Methods

Existing agent observability methods mainly operate at three layers, application-layer [4, 10, 11, 15], system-layer [2, 3, 6, 7, 17, 18], and cross-layer such as AgentSight [20]. Unfortunately, none of current methods can reconstruct the complete causal chain between LLM interactions and system actions to defend the reverse-shell attack in §2.1. Application-layer observability, such as LangSmith [10] and Langfuse [11], records prompts, responses, and frameworkdeclared tool calls. Its visibility is limited to frameworkexposed events. In the reverse-shell attack, it captures the originating interaction and cron installation, but misses the later cron execution, shell process, and network connection outside the agent framework. System-layer observability, such as Falco [18], Tracee [2], and label-propagating systems including Asbestos [5], HiStar [19], Flume [9], and whole-system provenance [13, 16], captures system calls and runtime activities, and the latter propagate labels across processes, files, and sockets to recover long-delayed causality. However, this layer lacks the LLM context needed to interpret what it captures: its labels are declared by label-aware applications and its graphs root at kernel-visible entities, so a natural-language request inside an encrypted stream is outside the observation range. IFC additionally gates actions at a reference monitor, yet writing to /etc/crontab is benign or malicious only relative to the request that prompted it. In the reverse-shell attack, it observes the cron execution, shell, and connection, and links crontab and payload.sh to the agent process, but the chain terminates there, a whole session is one node, not one LLM interaction [12].

A typical LLM agent combines an LLM backend, a toolexecution framework, and a control loop to translate LLM interactions into system actions such as process creation, file modification, and network access [20]. This architecture enables autonomous task execution, but it also creates security risks because erroneous or compromised agents can directly affect the host, while nondeterministic action sequences are difficult to vet statically. Although many actions remain within the agent’s process lineage, effects stored in persistent resources may later be triggered by unrelated processes after the agent exits, breaking the lineage-based link to the originating LLM interaction. Figure 1 shows a delayed cron-triggered reverse-shell attack. The attacker asks the agent to install an hourly cron job, and the agent writes a reverse-shell script, payload.sh, and a crontab entry that invokes it. One hour later, the system cron process, which lies outside the agent’s process lineage, reads the crontab, launches a shell process, and executes the 2

LLM Turn Prompt

Response

user-space TLS library

eBPF collector (3.2)

SSL_write

eBPF TLS Handler

SSL_read

Semantic Detector

Ring buffer (TLS)

HTTP msg

groups records by chain_id into a WAL-mode SQLite materialized view, which a FastAPI + Next.js layer renders as four analysis views and feeds to an online LLM risk analyzer.

Agent actions

kernel labeling (3.3) Label Logic

create label

Label Map

3.2

fork

HTTP msg

write

openat

User Space (3.4) 1. Record Decoder SSE / HTTP reassembly

2. Chain Grouper L1

L2

3. SQLite

L3

timeline

conversation

4. Snapshot Builder / Noise Reducer

group by label

Views (3.4)

LLM Analyzer (3.4) tree

prop-graph

threat confidence

Figure 2. AgentLoupe overview. Cross-layer observability, such as AgentSight [20]. The observation scope of AgentSight is bounded by the agent’s process tree, and its post-hoc correlation does not attach or propagate persistent causal metadata through system resources. In the reverse-shell attack, the causal dependency is carried across time and process lineage by the crontab and payload.sh. AgentSight does not preserve this resourcemediated dependency, thus cannot link the later cron execution and network connection back to the LLM interaction that installed the cron job.

3

AgentLoupe Design and Implementation

3.1

Insight and Architecture

In-Kernel Event Capture with eBPF

The collector observes two execution boundaries. Uprobes on the OpenSSL/BoringSSL calls SSL_write and SSL_read capture plaintext requests before encryption and responses after decryption. Kprobes capture the x86_64 system calls used to carry out each interaction. These include clone/fork, execve, file open and write, connect, socket send/receive and accept, and dup*/fcntl calls that alias descriptors. This makes AgentLoupe transparent to the application, requiring no changes to agent source code, no SDK integration, no proxy, and no gateway. Simply attach the Uprobes hook to the correct TLS entry point to adapt to different agent frameworks, such as Openclaw and Claude Code. The collector must classify LLM messages and assign a chain_id under eBPF verifier’s constraints. Each eBPF program has only a 512-byte stack, and each captured TLS record is capped at roughly 128 KiB. Thus AgentLoupe uses bpf_loop on Linux 5.17+ for bounded scanning and stores its scan buffer in a per-CPU scratch map. The TLS hook direction distinguishes requests from responses, while keyword matches identify prompts and responses. Since OpenAI and Anthropic markers occur near message starts, classification does not require the complete payload. The kernel performs only classification and labeling. User space handles byteexact assembly, decompression, and SSE reassembly, and receives truncated and bytes_lost flags for incomplete payloads. When a PID starts a new, independent prompt, the kernel assigns a fresh, monotonically increasing chain_id to the issuing thread and its SSL stream. The collector sends two record types to user space. TLS records contain plaintext fragments classified as prompts, responses, or tool calls by using a 64 MiB ring buffer. PROP records describe label propagation during process creation, program execution, file access, and socket operations (§3.3) by using a perf buffer. Every record carries a chain_id, so user space can group interaction content with the related system actions without inferring the association.

perf buffer (PROP)

Existing agent observability tools fail when causal chains cross process-lineage, time, or session boundaries. The core design of AgentLoupe is to embed semantic label to kernel resources and make each action carry the label that identifies the LLM interaction generating it. AgentLoupe lets that label travel with the resources the agent touches, so the association rides on the events themselves and is escrowed on the very files and sockets that mediate it. This enables complete, persistent, and definitive causal tracing across process-lineage, time, and session boundaries. Figure 2 shows the AgentLoupe architecture which includes in-kernel event capture, in-kernel label propagation, and the user-space audit pipeline. The in-kernel capture layer (§3.2) attaches uprobes to TLS library calls and kprobes to x86_64 system calls, recognizes prompt and response semantics in the kernel, and assigns a chain_id. The inkernel propagation module (§3.3) then propagates identifiers through BPF maps across processes, inodes, and sockets through rule-based inheritance, ensuring every emitted system event carries its corresponding chain_id. TLS records use a ring buffer and propagation (PROP) records use a perf buffer; the two streams are merged into one JSON object per line. Finally, the user-space pipeline (§3.4) reconstructs HTTP/SSE payloads, restores cross-channel ordering, and

3.3

In-Kernel Label Propagation

Starting with the thread labeled during TLS capture, AgentLoupe propagates the label only at explicit process or resource handoffs. A child inherits its parent’s label on fork or clone. When a labeled process writes a file, the write probe stores the process label on the file’s inode. A later openat transfers the stored label to the process opening the file. If the file is executed, the execve probe similarly transfers the inode label to the executing process. For network activity, connect and sendmsg stores the label in socket state, and recvmsg transfers it to the receiving process. AgentLoupe 3

Table 1. Completion time and overhead relative to Bare.

requires no kernel modifications, it maintains causal labels in eBPF maps keyed by resource identities. Uncontrolled label propagation can cause dependency explosion, a common risk in information-flow systems. AgentLoupe bounds this risk with a non-tunable semantic rule: a label propagates only through the explicit handoffs above to processes and resources causally downstream of agent actions. Each independent LLM prompt starts a new causal slice instead of inheriting the previous chain. For example, a benign session may load a poisoned AGENTS.md and inherit its label. On receiving a user prompt, AgentLoupe creates a fresh chain_id and emits one PROP record with a related_chain_id field pointing to the old chain_id. This preserves the cross-chain influence relationship, while preventing independent records from being merged into a single causal chain when grouping in user space. A rollback guard blocks new label replaced by older label, while a cross-session guard blocks labels from another session. Rejected transfers remain visible PROP record containing cross-chain links; user-configurable time-based expiry and blacklists further reduce noise. 3.4

Task

User-Space Components

no-prop

AgentLoupe

174.70s 102.90s 23.40s

169.97s 103.49s 22.97s

174.65s 108.40s 24.78s

Overhead (repo) Overhead (write) Overhead (compile)

— — —

+4.5% +2.5% +1.7%

+1.7% +3.1% −0.1%

+4.5% +8.0% +7.7%

4.2

Case Studies

We evaluate end-to-end pipeline on two cross-boundary behaviors. For each, AgentLoupe groups the captured trace by chain_id and hands the resulting per-chain snapshot, together with the chains linked to it, to the LLM risk analyzer. Delayed cron-triggered reverse shell. This is attack introduced in §2.1. AgentLoupe recorded 165 raw log entries over five LLM interactions within a single session chain and preserved the full path from the originating user request through the persistent artifact and the delayed execution to the network evidence: the script inode carried the chain label at write time, the association was recovered when the scheduler opened and executed the files, and the ensuing network connection was likewise associated. Grouping these events by their kernel-assigned chain_id attributed the lineageexternal behavior back to the LLM interaction that produced the script, and the analyzer reported threat level 5 at confidence 0.95 with two confirmed findings—a persistence finding for the root cron entry and a critical reverse-shell finding for the interactive shell and loopback connection. For this behavior, application-layer observability (LangSmith, Langfuse, OpenTelemetry GenAI) [10, 11, 15] can record the triggering LLM turn and, when the framework emits it, the scriptwriting tool call, but the cron scheduler’s execution, the bash -i process, and the connection are un-instrumented system effects it never observes. AgentSight [20] does observe system effects, yet its user-space correlation cannot tie them to the originating interaction: the scheduler-spawned shell is lineage-external and excluded by the process-tree observation scope; even with broadened collection there is

Evaluation

We run Claude Code 2.1.150 with the claude-sonnet-5 model on Ubuntu 26.04 (kernel 7.0, x86_64; 4-core Intel Xeon 6982P-C, 8 GB RAM). 4.1

AgentSight

167.14s 100.40s 23.00s

bare (no observation tool), AgentSight, AgentLoupe with propagation disabled (no-prop), and full AgentLoupe. We report the mean end-to-end completion time over five runs. As Table 1 shows, full AgentLoupe adds at most 8% across the three tasks (repository understanding 4.5%, code writing 8.0%, source compilation 7.7%). Crucially, AgentLoupe’s capture-only cost (no-prop) is close to or below AgentSight (e.g., −0.1% vs. 1.7% on compilation); the remaining overhead comes entirely from label propagation where AgentSight does not afford. The syscall-intensive compilation task with few LLM round-trips, minimizes this propagation cost. On longer LLM-bound tasks, the tool overhead is dwarfed by network and latency variance as well as run-to-run differences in the number of LLM turns.

Since each record already carries its chain_id, the userspace side only reconstructs and presents the trace without inferring the association. record_decoder restores the exact bytes from the ring-buffer stream: it removes HTTP chunking, decompresses Brotli, gzip, and deflate, and reassembles Server-Sent Events and one-shot JSON into complete requests and responses. ChainGrouper then groups all records by chain_id, turns PROP records into audit events, and writes them into a WAL-mode SQLite materialized view; snapshot_builder and noise_reducer build per-chain snapshots and drop known-noisy paths. A FastAPI backend serves this view to a Next.js frontend as coordinated views (timeline, session, process tree, and PROP graph), so an analyst can follow one chain across processes, files, and sockets. Finally, for each captured trace, AgentLoupe assembles the chain and its linked chains into a single prompt and sends it to the LLM risk analyzer, which returns evidence-grounded risk findings, each with a threat level, a confidence, and the events that support it.

4

Bare

Repo. understanding Code writing Source compilation

End-to-End Overhead

We execute three workloads. 1) repository understanding (reading the AgentLoupe repository and running /init to produce a CLAUDE.md). 2) code writing (writing and validating a cpufreq.bt CPU-frequency monitor) 3) source compilation (make agentloupe in a clean source copy). We compare 4

References

no process-lineage edge to the agent, and the cron delay exceeds its temporal-proximity window. Cross-session persistent instruction poisoning. In one session, a chain wrote an instruction into AGENTS.md that mapped normal query to the command /bin/sh -lc ’echo hacked’; later, an independent session launched and, on receiving an ordinary user request, silently executed the malicious command. AgentLoupe recorded 126 raw log entries over five LLM interactions across two session chains. Because the file inode carried the writing chain’s label and it was recovered when the second session opened the file, the snapshot linked the producing chain to the executing session’s chain through AGENTS.md. The analyzer reported threat level 5 at confidence 0.90 with three confirmed findings: persistent instruction injection, intent deviation, and unauthorized command execution. AgentSight can observe both sessions’ system activity, but its user-space correlation still cannot link them: the writing and executing sessions are distinct process trees with no lineage edge, and the delay spans a full session boundary and thus exceeds any temporal-proximity window. As a result, the poisoning cannot be traced back to its source.

5

[1] Anthropic. 2025. Claude Code. https://claude.com/product/claudecode [2] Aqua Security. 2024. Tracee: Runtime Security and Forensics using eBPF. Aqua Security. https://github.com/aquasecurity/tracee [3] Gianluca Borello. 2015. System and application monitoring and troubleshooting with sysdig. (2015). [4] Liming Dong, Qinghua Lu, and Liming Zhu. 2024. AgentOps: Enabling Observability of LLM Agents. ArXiv abs/2411.05285 (2024). [5] Petros Efstathopoulos, Maxwell Krohn, Steve VanDeBogart, Cliff Frey, David Ziegler, Eddie Kohler, David Mazières, Frans Kaashoek, and Robert Morris. 2005. Labels and Event Processes in the Asbestos Operating System. In Proceedings of the 20th ACM Symposium on Operating Systems Principles (SOSP ’05). [6] Peng Jiang, Ruizhe Huang, Ding Li, Yao Guo, Xiangqun Chen, Jianhai Luan, Yuxin Ren, and Xinwei Hu. 2023. Auditing frameworks need resource isolation: A systematic study on the super producer threat to system auditing and its mitigation. In 32nd USENIX Security Symposium (USENIX Security 23). [7] Peng Jiang, Hanlin Jiang, Ruizhe Huang, Hanwen Lei, Zhineng Zhong, Shaokun Zhang, Yuxin Ren, Ning Jia, Xinwei Hu, Yao Guo, et al. 2025. DPUaudit: DPU-assisted Pull-based Architecture for Near-Zero Cost System Auditing. In 2025 IEEE International Symposium on High Performance Computer Architecture (HPCA’25). [8] The kernel development community. [n. d.]. eBPF documentation. ht tps://www.kernel.org/doc/html/latest/bpf/index.html [9] Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. 2007. Information Flow Control for Standard OS Abstractions. In Proceedings of the 21st ACM Symposium on Operating Systems Principles (SOSP ’07). [10] LangChain. 2024. LangSmith Observability. LangChain. https://docs .smith.langchain.com/observability [11] Langfuse. 2024. Langfuse: LLM Observability and Application Tracing. Langfuse. https://langfuse.com/ [12] Kyu Hyung Lee, Xiangyu Zhang, and Dongyan Xu. 2013. High Accuracy Attack Provenance via Binary-based Execution Partition. In Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS ’13). [13] Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, R. Sekar, and V. N. Venkatakrishnan. 2019. HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows. In 2019 IEEE Symposium on Security and Privacy (SP ’19). [14] OpenClaw. 2025. OpenClaw – Personal AI Assistant. https://github.c om/openclaw/openclaw [15] OpenTelemetry Authors. 2024. OpenTelemetry Generative AI Semantic Conventions. OpenTelemetry. https://opentelemetry.io/docs/specs/se mconv/gen-ai/ [16] Thomas Pasquier, Xueyuan Han, Mark Goldstein, Thomas Moyer, David Eyers, Margo Seltzer, and Jean Bacon. 2017. Practical WholeSystem Provenance Capture. In Proceedings of the 2017 Symposium on Cloud Computing (SoCC ’17). [17] R Sekar, Hanke Kimm, and Rohit Aich. 2024. eaudit: A fast, scalable and deployable audit data collection system. In 2024 IEEE Symposium on Security and Privacy (SP’24). [18] The Falco Authors. 2024. Falco: Cloud Native Runtime Security. CNCF. https://falco.org/ [19] Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. 2006. Making Information Flow Explicit in HiStar. In Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’06). [20] Yusheng Zheng, Yanpeng Hu, Tong Yu, and Andi Quinn. 2025. AgentSight: System-Level Observability for AI Agents Using eBPF. Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems (2025).

Open Challenges and Conclusion

Propagation fidelity. Although this work has achieved a limited propagation mechanism and a user-customizable noise reduction mechanism, the risk of dependency explosion still exists, the false-positive and false-negative rates of label propagation remain unquantified. Future work requires experiments with ground-truth chains to measure over-tainting (dependency explosion) and under-tainting (missed links) across diverse workloads. Evaluation generality. The current evaluation is based only on case studies. Broader validation requires testing against real-world agent attacks and attack benchmarks to demonstrate effectiveness, diverse runtimes beyond Claude Code and OpenClaw, same-environment baseline comparisons on cross-boundary scenarios, and ground-truth measurements of link accuracy and LLM analyzer accuracy. Conclusion. We presented AgentLoupe, a system-level observability tool that establishes LLM-to-system causal correlation in the kernel. The core insight of AgentLoupe is to embed, assign and propagate kernel-resident semantic chain labels across processes, files, and sockets. Experiments show that AgentLoupe reliably traces cross-lineage persistent attacks back to their originating LLM interactions while imposing less than 8% runtime overhead.

Acknowledgments We are thankful to the anonymous PACMI reviewers for their valuable feedback. The research on which this paper is based was supported by CCF-ANT RESEARCH FUND. 5

Related documents

• Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems#622440
• Advancing U.S. Competitiveness Through Governance Tools and Trustworthy Frameworks for Autonomous GenAI Agentic Systems#85579
• LogicHunter: Testing LLM Agent Frameworks with an Agentic Oracle#346575
• Can Agents Infer Environment from Interaction? Evidence from Agentic Automata Learning#1117470
• Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry#178820