Tag
Ebpf
2essays ·All tags
When Your Incident Response Requires an AI Model, You've Already Lost
Hugging Face tried to use commercial frontier models to reconstruct a security incident and got blocked by safety filters. The problem isn't the safety filters. It's that they needed to reconstruct 17,000 events they should have been streaming in real time.
Kernel-Level Kill-Switch: eBPF Process Containment for Agents
When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon — Panguard sees the tool call; eBPF sees what actually ran.