--- title: Runtime Observability and Enforcement for Opaque AI... description: AI coding agents now run autonomously for hours, completing entire features and merging thousands of PRs — but security models haven't kept pace.... canonical: https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Runtime Observability and Enforcement for Opaque AI Agents with eBPF: Beyond Sandboxes and Approvals | daily.dev og:description: AI coding agents now run autonomously for hours, completing entire features and merging thousands of PRs — but security models haven't kept pace.... og:url: https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto og:image: https://api.daily.dev/og/posts/tuG8UecTo.png og:image:alt: Runtime Observability and Enforcement for Opaque AI Agents with eBPF: Beyond Sandboxes and Approvals og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Runtime Observability and Enforcement for Opaque AI Agents with eBPF: Beyond Sandboxes and Approvals **[eunomia eBPF Blog](https://daily.dev/sources/eunomia)** · 20 min read · 0 upvotes · 0 comments ## Summary AI coding agents now run autonomously for hours, completing entire features and merging thousands of PRs — but security models haven't kept pace. Approval-based controls are failing: Anthropic data shows 93% of Claude Code permission prompts are rubber-stamped, and 65% of firms report agent security incidents. The core problem is that the agent harness is increasingly a third-party product the platform team doesn't own or fully control. The post argues for separating agent security into three independent layers: intent authorization (MCP/tool gateways), execution isolation (sandboxes/containers), and side-effect verification (OS-level observability). The third layer — owned by the environment operator — is what most platforms are missing. eBPF is proposed as the mechanism for this independent runtime layer, with two open-source tools introduced: AgentSight (zero-instrumentation observability via eBPF SSL/TLS interception and process monitoring) and ActPlane (kernel-level enforcement via YAML behavioral contracts compiled to eBPF programs). The post includes a practical checklist for platform teams and a threat model covering compromised agents, untrusted harnesses, and sandbox escapes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of Claude Code permission prompts do users approve without meaningful review? Claude Code users approve 93% of permission prompts, a rate consistent with rubber-stamping rather than meaningful review. An independent stress test of Claude Code's auto mode found an 81% false negative rate on ambiguous state-changing actions, meaning the classifier allowed 4 out of 5 actions that should have required human review. _Platform teams securing AI agent deployments track incidents like these on daily.dev._ ### What are the three security layers needed for AI agent deployments and who owns each? The three layers are: intent authorization (owned by the agent harness — MCP, tool gateways, approval prompts answering what the agent is supposed to do), execution isolation (contested ownership — containers, VMs, network policy answering what the agent can reach), and side-effect verification (must be platform-owned — OS/runtime observability answering what actually happened). Each is necessary; none is sufficient alone. _Engineers designing agent security architecture find the latest frameworks and real-world deployments on daily.dev._ ### How does AgentSight use eBPF to monitor AI agents without code changes? AgentSight intercepts SSL/TLS traffic and monitors process behavior at the system boundary using eBPF, requiring no code changes, no SDKs, and no framework integration. It captures process lineage, LLM API calls including prompts and completions, file access, network connections, and tool invocations, all correlated into a live timeline — working even when the agent runtime is opaque, closed-source, or spawns arbitrary subprocesses. _Developers building agent observability pipelines follow eBPF tooling developments on daily.dev._ ## Similar posts on daily.dev - [Kernel-Level Ground Truth: Why eBPF is Replacing User-Space Agents for Security Observability](https://daily.dev/posts/kernel-level-ground-truth-why-ebpf-is-replacing-user-space-agents-for-security-observability-92jvpmrxl) · InfoQ · 0 upvotes · 0 comments - [Every dev should know about AI sandboxes](https://daily.dev/posts/every-dev-should-know-about-ai-sandboxes-cfpxzueug) · Engineer’s Codex · 1 upvotes · 0 comments - [AI Agents Are Actors, Not Tools: Why Enterprises Need a New Layer of Runtime Governance](https://daily.dev/posts/ai-agents-are-actors-not-tools-why-enterprises-need-a-new-layer-of-runtime-governance-mhbt7bmik) · strongdm · 6 upvotes · 1 comments - [Redefining Security for the Agentic Era](https://daily.dev/posts/redefining-security-for-the-agentic-era-hvpblwcfj) · Cisco · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Runtime Observability and Enforcement for Opaque AI Agents with eBPF: Beyond Sandboxes and Approvals","url":"https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto"},"datePublished":"2026-08-11T08:52:24.573Z","dateModified":"2026-08-11T09:00:36.257Z","description":"AI coding agents now run autonomously for hours, completing entire features and merging thousands of PRs — but security models haven't kept pace....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"eunomia eBPF Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"eunomia eBPF Blog","logo":"https://media.daily.dev/image/upload/s--z-nTl7TK--/f_auto,q_auto/v1786438304/logos/eunomia?_a=BAMAMicg0","url":"https://daily.dev/sources/eunomia"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ai-agents","timeRequired":"PT20M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"eunomia eBPF Blog","item":"https://daily.dev/sources/eunomia"},{"@type":"ListItem","position":3,"name":"Runtime Observability and Enforcement for Opaque AI Agents with eBPF: Beyond Sandboxes and Approvals"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/runtime-observability-and-enforcement-for-opaque-ai-agents-with-ebpf-beyond-sandboxes-and-approvals-tug8uecto#faq","mainEntity":[{"@type":"Question","name":"What percentage of Claude Code permission prompts do users approve without meaningful review?","acceptedAnswer":{"@type":"Answer","text":"Claude Code users approve 93% of permission prompts, a rate consistent with rubber-stamping rather than meaningful review. An independent stress test of Claude Code's auto mode found an 81% false negative rate on ambiguous state-changing actions, meaning the classifier allowed 4 out of 5 actions that should have required human review. Platform teams securing AI agent deployments track incidents like these on daily.dev."}},{"@type":"Question","name":"What are the three security layers needed for AI agent deployments and who owns each?","acceptedAnswer":{"@type":"Answer","text":"The three layers are: intent authorization (owned by the agent harness — MCP, tool gateways, approval prompts answering what the agent is supposed to do), execution isolation (contested ownership — containers, VMs, network policy answering what the agent can reach), and side-effect verification (must be platform-owned — OS/runtime observability answering what actually happened). Each is necessary; none is sufficient alone. Engineers designing agent security architecture find the latest frameworks and real-world deployments on daily.dev."}},{"@type":"Question","name":"How does AgentSight use eBPF to monitor AI agents without code changes?","acceptedAnswer":{"@type":"Answer","text":"AgentSight intercepts SSL/TLS traffic and monitors process behavior at the system boundary using eBPF, requiring no code changes, no SDKs, and no framework integration. It captures process lineage, LLM API calls including prompts and completions, file access, network connections, and tool invocations, all correlated into a live timeline — working even when the agent runtime is opaque, closed-source, or spawns arbitrary subprocesses. Developers building agent observability pipelines follow eBPF tooling developments on daily.dev."}}]} ```