The Agent's Second Record: What Its Tools Actually Execute
TL;DR for operators An enterprise agent can invoke a legitimate-looking tool while its underlying process accesses credentials, launches additional commands, or transmits data. The conversation transcript may never reveal those side effects. But monitoring execution alone can also miss attacks that manipulate what the agent reads or decides. The Agent Cross-Layer Evidence (ACE) benchmark shows why the distinction matters. For silent exfiltration through logging, application evidence barely distinguishes malicious sessions (AUROC 0.586), while operating-system evidence performs strongly (0.976). For retrieval-reference injection, the relationship reverses: application evidence reaches 0.906 versus 0.703 for kernel evidence. These are mean in-distribution results across 10 learned detectors. Combining both evidence sources leads all 10 detectors in-distribution and seven under held-out-attack-family evaluation, although kernel-only evidence wins for some detectors and attack mechanics. ...