AgentShield: Stopping a Rogue AI Agent in the Linux Kernel

On stage, an AI agent in a real container tries to exfiltrate an LLM key — and succeeds in seconds.

We turn on AgentShield and run the same task. Three layers intervene at once: a kernel check suspends the suspicious process, a network-layer check denies the outbound connection, and a TLS-layer swap replaces the real API key with a phantom one. The agent believes it succeeded. The real key never leaves the host.

The Dashboard shows a live causal chain — every kernel event linked to the LLM prompt and tool call that caused it. When the operator clicks Deny, the same message arrives back at the agent as a typed tool error.

We then disable each layer one at a time to show what slips through, and kill the daemon to show the host stays alive.

Attendees leave with a concrete pattern for making any tool-using AI agent observable and containable — from inside the Linux kernel.

Location :
- Track 3(Room 3)
Category :
- Bluebox
Share :

Speakers

Weixiao JI

ウェイシャオ・ジー

Weixiao Ji is a security engineer on the Security Research and Innovation Team at Lenovo's Global Security Lab in Beijing, where he works on Linux kernel observability and runtime protection. He is the creator of AgentShield, an eBPF-based system that makes autonomous AI agents observable and containable by enforcing boundaries directly in the kernel. He is a co-author of Efidrill — Automated Hunting UEFI Firmware Vulnerability through Data-Flow Analysis — presented at Black Hat Asia 2024 Arsenal (https://www.blackhat.com/asia-24/arsenal/schedule/#efidrill-automated-hunting-uefi-firmware-vulnerability-through-data-flow-analysis-36764): the first open-source IDA plugin for data-flow analysis of UEFI firmware, which discovered multiple vulnerabilities on platforms from Asus, Intel, and Dell (https://github.com/cc-crack/efidrill). His research focuses on applying eBPF, LSM hooks, and credential isolation to the new threat surface opened up by tool-using LLM agents.

Weixiao Ji is a security engineer on the Security Research and Innovation Team at Lenovo's Global Security Lab in Beijing, where he works on Linux kernel observability and runtime protection. He is the creator of AgentShield, an eBPF-based system that makes autonomous AI agents observable and containable by enforcing boundaries directly in the kernel. He is a co-author of Efidrill — Automated Hunting UEFI Firmware Vulnerability through Data-Flow Analysis — presented at Black Hat Asia 2024 Arsenal (https://www.blackhat.com/asia-24/arsenal/schedule/#efidrill-automated-hunting-uefi-firmware-vulnerability-through-data-flow-analysis-36764): the first open-source IDA plugin for data-flow analysis of UEFI firmware, which discovered multiple vulnerabilities on platforms from Asus, Intel, and Dell (https://github.com/cc-crack/efidrill). His research focuses on applying eBPF, LSM hooks, and credential isolation to the new threat surface opened up by tool-using LLM agents.
Qingzhe Jiang

チンジャー・ジャン

I am a security researcher with over 10 years of experience in cybersecurity and currently serve as Senior Manager and Head of the Security Research and Innovation Department at Lenovo. My work focuses on AI agent and LLM security, automated vulnerability discovery, and IoT and PC firmware security. I have also contributed to the development of several commercial APT detection engines.

I am a security researcher with over 10 years of experience in cybersecurity and currently serve as Senior Manager and Head of the Security Research and Innovation Department at Lenovo. My work focuses on AI agent and LLM security, automated vulnerability discovery, and IoT and PC firmware security. I have also contributed to the development of several commercial APT detection engines.

Back to Time Table