--- title: With AI agents, runtime is the only place truth lives description: AI agents break the two assumptions underlying traditional security controls: deterministic software behavior and human-attached identity. Since agents write... canonical: https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: With AI agents, runtime is the only place truth lives | daily.dev og:description: AI agents break the two assumptions underlying traditional security controls: deterministic software behavior and human-attached identity. Since agents write... og:url: https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz og:image: https://api.daily.dev/og/posts/0KzQ21iKZ.png og:image:alt: With AI agents, runtime is the only place truth lives og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # With AI agents, runtime is the only place truth lives **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 9 min read · 1 upvotes · 0 comments ## Summary AI agents break the two assumptions underlying traditional security controls: deterministic software behavior and human-attached identity. Since agents write their own plans at runtime and can act in seconds (one case diagnosed and fixed its own login failure in 31 seconds), human-speed review can't keep pace. Citing the JADEPUFFER agentic ransomware campaign and OpenAI/Anthropic incidents where agents reached production systems, the piece argues an agent's self-reported logs can be forged or erased if it's compromised, making them untrustworthy as evidence. The proposed fix is runtime defense with four properties: observing below the agent (kernel-level syscalls), observing inside the agent (hooks, session data, prompts), correlating both views to detect disagreement as the strongest signal of compromise, and judging/acting at the exact moment of execution. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't you trust an AI agent's own logs for security incident investigation? Because if an agent is compromised or acting maliciously, it can forge or erase the record of what it did. Agent logs show prompts received and tool calls claimed, which are valuable as context, but at the moment an agent is hijacked, that same data loses all evidentiary validity since the software generating it is the thing that's been compromised. _Teams securing AI agent deployments can follow runtime security approaches like this on daily.dev._ ### What was the JADEPUFFER agentic ransomware campaign and how fast did it operate? JADEPUFFER was the first documented end-to-end agentic ransomware campaign, discovered by Sysdig's threat research team, where an attacker pointed an AI agent at a CVE and let it run an entire extortion campaign autonomously. Notably, the agent triaged and fixed its own login failure in 31 seconds, diagnosing the mistake and launching a working fix in under a minute. _Developers tracking agentic attack speed and automated exploitation can find writeups like this on daily.dev._ ### What properties does effective runtime security for AI agents require? Four non-negotiable properties: observing below the agent at the kernel level (syscalls, files, connections), observing inside the agent via hooks and session data agent harnesses like Claude Code or Codex expose, correlating both views so disagreements between reported and actual behavior become the detection signal itself, and judging and blocking actions at the exact moment of execution rather than after the fact. _Architects designing AI agent governance can compare runtime security models like this on daily.dev._ ## Similar posts on daily.dev - [The runtime reckoning: How the agentic evolution is reshaping security](https://daily.dev/posts/the-runtime-reckoning-how-the-agentic-evolution-is-reshaping-security-6hzvabqm9) · Dynatrace · 2 upvotes · 0 comments - [Runtime: The new frontier of AI agent security](https://daily.dev/posts/runtime-the-new-frontier-of-ai-agent-security-3ql0bgs0k) · CSO Online · 0 upvotes · 0 comments - [Runtime AI Defense in a shared responsibility model](https://daily.dev/posts/runtime-ai-defense-in-a-shared-responsibility-model-e0q39x5xx) · Sysdig Blog · 0 upvotes · 0 comments - [Sysdig Adds Runtime to Secure AI Coding Agents](https://daily.dev/posts/sysdig-adds-runtime-to-secure-ai-coding-agents-zphwjnqye) · DevOps.com · 0 upvotes · 0 comments - [The two speeds of AI agent runtime security](https://daily.dev/posts/the-two-speeds-of-ai-agent-runtime-security-opzw70ons) · Arcjet · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#sysdig](https://daily.dev/tags/sysdig) [View this post on daily.dev](https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"With AI agents, runtime is the only place truth lives","url":"https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz"},"datePublished":"2026-10-01T13:51:53.880Z","dateModified":"2026-10-01T13:52:16.911Z","description":"AI agents break the two assumptions underlying traditional security controls: deterministic software behavior and human-attached identity. Since agents write...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec048664949a24c67881336986590bfd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec048664949a24c67881336986590bfd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sysdig Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sysdig Blog","logo":"https://media.daily.dev/image/upload/s--1S2uMy2c--/f_auto,q_auto/v1780213305/logos/sysdig-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sysdig-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,sysdig","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sysdig Blog","item":"https://daily.dev/sources/sysdig-blog"},{"@type":"ListItem","position":3,"name":"With AI agents, runtime is the only place truth lives"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/with-ai-agents-runtime-is-the-only-place-truth-lives-0kzq21ikz#faq","mainEntity":[{"@type":"Question","name":"Why can't you trust an AI agent's own logs for security incident investigation?","acceptedAnswer":{"@type":"Answer","text":"Because if an agent is compromised or acting maliciously, it can forge or erase the record of what it did. Agent logs show prompts received and tool calls claimed, which are valuable as context, but at the moment an agent is hijacked, that same data loses all evidentiary validity since the software generating it is the thing that's been compromised. Teams securing AI agent deployments can follow runtime security approaches like this on daily.dev."}},{"@type":"Question","name":"What was the JADEPUFFER agentic ransomware campaign and how fast did it operate?","acceptedAnswer":{"@type":"Answer","text":"JADEPUFFER was the first documented end-to-end agentic ransomware campaign, discovered by Sysdig's threat research team, where an attacker pointed an AI agent at a CVE and let it run an entire extortion campaign autonomously. Notably, the agent triaged and fixed its own login failure in 31 seconds, diagnosing the mistake and launching a working fix in under a minute. Developers tracking agentic attack speed and automated exploitation can find writeups like this on daily.dev."}},{"@type":"Question","name":"What properties does effective runtime security for AI agents require?","acceptedAnswer":{"@type":"Answer","text":"Four non-negotiable properties: observing below the agent at the kernel level (syscalls, files, connections), observing inside the agent via hooks and session data agent harnesses like Claude Code or Codex expose, correlating both views so disagreements between reported and actual behavior become the detection signal itself, and judging and blocking actions at the exact moment of execution rather than after the fact. Architects designing AI agent governance can compare runtime security models like this on daily.dev."}}]} ```