AgentSpy: Making AI Agent Behavior Observable

• Outcome tests can pass despite unrelated activity, static analyzers cannot observe runtime behavior, and trajectories omit subprocess actions and depend on agent-reported records.Trajectory interpretation may also rely on nondeterministic LLM judges that can miss details or be misled by adversarial tool output.Source: §1 · p. 2
• AgentSpy records system calls and network traffic from agents and every process they execute inside an isolated, declaratively configured environment.This makes evidence deterministic and independent of the agent's own account.Source: §1 · p. 2
• The reliability analysis measures obligations and summarizes commands, files, and hosts, while the security analysis checks prohibitions using deterministic system-call rules.Reliability compares repeated runs and measures use of developer guidance; security can report a violation after a single system call.Source: §1 · p. 2
• AgentSight [58] focuses on matching actions to LLM messages, while SkillDetonate [29] audits skills before installation; AgentSpy supports run-to-run comparisons and task executions.AgentSpy's security alerts identify the matching rule, system call, and process.Source: §1 · pp. 2–3
• 92.2% of comparisons found repeated runs of the same task more similar than sets including another task's runs.Among tasks whose runs all passed tests, unrelated activities occurred in 18% of cases, grading files were read in 7%, and developer guidance was unused in 17%.Source: §1 · p. 3

2.1 Agentic AI Systems and Agent Skills

• Agent skills package reusable domain knowledge in instructions and may include helper scripts, reference documents, and assets loaded when relevant to a task.At startup, an agent loads skill names and descriptions and may load full instructions when a description matches the task.Source: §2.1 · p. 3

2.2 Running Example

• In citation-check, the agent must identify fabricated BibTeX entries and write their titles to answer.json; the task includes a citation-management skill and nine tests.The skill recommends searches, DOI resolution through Crossref, and validation with a helper script.Source: §2.2 · p. 4

2.3 Limits of the Agent Trajectory

• Agent trajectories require interpreting thoughts, commands, code, and tool outputs, yet record only one action at a time and omit files, hosts, and processes used by helper scripts.System-level monitoring captures commands, accessed files, and contacted endpoints, including events delegated to scripts or triggered by compromised skills.Source: §2.3 · pp. 4–5

• AgentSpy takes a task, an agent configured with a foundation model, and a behavior-analysis type as input, and produces an analysis report.Source: §3 · p. 5
• The orchestrator reads the execution kind and starts a new isolated execution environment for the task.Source: §3 · p. 5
• Within that environment, the execution manager sets up and runs the agent, evaluates the execution, and gathers artifacts for the analysis runner to process.The orchestrator copies the artifacts out of the environment before analysis.Source: §3 · p. 5

• The task supplied to the orchestrator includes its description and dependencies, and may include skills with guiding documents and scripts.The citation-check task, for example, comes with a Dockerfile and citation-management skill.Source: §3.1 · p. 5
• An execution kind configures a class of tasks; its custom form specifies task-specific setup and validation, agent parameters, and analysis steps.Custom kinds extend the base configuration for the environment.Source: §3.1 · p. 5
• The orchestrator monitors the isolated environment, which records agent actions at the system level and prevents them from affecting the host system.Source: §3.1 · p. 6

• The manager provisions task-specific dependencies, executes lifecycle hooks, configures runtime observation, runs the agent, and collects artifacts.Each step has a configurable timeout; an orchestrator-enforced global timeout can terminate the environment at any phase.Source: §3.2 · p. 6
• Monitoring starts after preparation and stops before collection, so dependency installation and copying out results are not recorded as agent behavior.Source: §3.2 · p. 6
• If the agent fails or times out, post-run steps still execute so partial behavior remains available for analysis.Source: §3.2 · p. 6

• Conformance analyses score whether an execution fulfills obligations, while safety analyses alert when a prohibited system call occurs.Obligations are assessed at run end; a single call can establish a safety violation.Source: §3.3 · p. 6
• Reliability measures whether agents follow task guidance consistently across runs, while security targets confidentiality, integrity, and availability.Source: §3.3 · p. 6
• The two analysis families are complementary: ignoring guidance may fail an obligation without violating a prohibition, while following malicious skill instructions may do the reverse.Source: §3.3 · p. 6
• Developers can add analyzers over the same observation boundary to express further obligations or prohibitions.Examples include requiring an external source check or forbidding edits to skill files.Source: §3.3 · p. 6
• Figure 2 represents each resource as a node connected to the execution root, with edges recording action counts and trajectory-row tags.Source: Figure 2 · p. 7

3.4 Conformance Analysis: Reliability

• Kernel-level logging captures system calls by the agent and its subprocesses, retaining calls that refer to environment resources while excluding frequent calls without such references.Resource-bearing calls include starting programs, opening files for reading or writing, and connecting to hosts.Source: §3.4 · p. 7, §3.4.1 · p. 7

3.4.1 Star graph.

• The star graph links the execution root to resource nodes for commands, file accesses, and hosts, recording action type and count while abstracting away which process performed each action.Resource names remain comparable across runs, unlike changing process IDs; differences therefore point to particular resources.Source: §3.4.1 · p. 7

3.4.2 Quantitative metrics.

• Similarity compares proportions of commands, file accesses, and hosts using weighted Jaccard scores, averaged across resource types and run pairs; skill coverage measures the fraction of skill files used.Similarity is 1 for runs with the same resources in the same proportions and 0 when they share no resources.Source: §3.4.2 · p. 8

3.4.3 Example of AgentSpy’s reliability analysis.

• R3 differs from R1 and R2 despite all three runs passing nine tests; its command similarity to each is 0.36.The graph lets developers identify which run and resources merit inspection.Source: §3.4.3 · p. 9, Table 2 · p. 9
• All three runs show very low skill coverage and none follows the whole skill procedure, although they pass the nine tests.The agents solve the task from first principles, using custom approaches and ignoring developer guidance.Source: §3.4.3 · p. 9

3.5 Safety Analysis: Security

• The analysis targets compromised skills that can induce unauthorized actions or assemble harmful behavior from benign capabilities, including exfiltration, resource modification or destruction, and disruption.Source: §3.5 · pp. 9–10

3.5.1 Rules over system calls.

• Four rule classes cover credential and secret reads, file changes outside the workspace, programs from untrusted locations or privilege gains, and network activity to untrusted domains.Source: §3.5.1 · p. 10
• Each rule checks a system call, and AgentSpy reports the violated rule and relevant process details; task-specific allow lists can accommodate legitimate external resources without changing rules.Source: §3.5.1 · p. 10
• Unlike a sandbox that blocks boundary-crossing actions, AgentSpy lets a compromised-skill attack run in isolation and raises alerts as matching system calls occur.In the citation-check example, calls opening a private SSH key and contacting an untrusted host trigger separate alerts.Source: §3.5.1 · p. 10, §3.5.2 · p. 10

3.6 Implementation

• AgentSpy runs each execution in a Firecracker microVM booted from a reusable Ubuntu root filesystem, giving runs of the same execution kind the same starting state.The analysis runner reads collected artifacts, so analyses can be repeated or replaced without rerunning the agent.Source: §3.6 · p. 10
• The agent setup uses codex CLI 0.146.0 non-interactively with plugins disabled; codex is the default, while Claude Code is used in manual mode.The isolated environment is built once per execution kind and reused unchanged.Source: §3.6 · p. 10
• Reliability monitoring uses auditd rules for the agent user and process tree, laurel to resolve execve arguments, and Zeek network logs to map addresses to host names.The reliability analysis runner processes the collected artifacts separately from agent execution.Source: §3.6 · p. 10
• The malicious citation-skill example shows a script exfiltrating private keys before expected validation, while the trajectory records one tool call and system logs capture the script’s behavior.The figure contrasts agent-reported activity with system-level records.Source: Figure 3 · p. 11, §3.6 · p. 11
• Security analysis runs Falco 0.44.1 with the paper’s rules instead of default rules, using modern_ebpf and a kernel with BTF and kprobe support.The Falco configuration is specified for the security analysis.Source: §3.6 · p. 11

4.1 RQ1: Reliability Analysis

• 92.2% of comparisons across three models favored same-task repeated runs over mixed-task sets; combining commands, files, and hosts yielded positive margins for the most tasks.On gpt-5.6-terra, homogeneous sets had higher similarity than mixed sets in 93.5% of comparisons.Source: Figure 4 · p. 12, §4.1 · p. 13

4.2 RQ2: Comparison with Outcome-based Testing

• 18.2% of passing task–model pairs involved unrelated activity, 17.0% lacked skill guidance, and agents read benchmark test files in 6 tasks.The manual inspection covered 88 task–model pairs whose three runs all passed their tests.Source: Table 3 · p. 14, §4.2 · pp. 14–15

4.3 RQ3: Security Analysis

• AgentSpy detected 14 of 18 executed injected behaviors (precision = 1.00, recall = 0.78), detected every successful S1–S4 attack, and missed only S5 backdoors.The missed backdoor changes stayed in the permitted workspace without network activity; detecting them would require a task-specific rule.Source: Figure 5 · p. 15, §4.3 · p. 16

4.4 RQ4: Efficiency

• No runtime comparison showed a significant difference with monitoring enabled; ten runs per condition made the test sensitive only to large effects.The reported p-values all exceeded α = 0.05.Source: §4.4 · pp. 16–17, Table 4 · p. 17

4.5 Threats to Validity

• The evaluation used the codex harness, a limited set of models, and selected reliability and security datasets, so results may differ with other harnesses.The authors describe harness choice and dataset coverage as external-validity threats.Source: §4.5 · p. 17

Trajectory analysis of AI agents

• Trajectory analyses [35] [36] [1] [32] [51] rely on agent-reported records, whereas AgentSpy observes outside the agent process and captures helper-script actions.This complements analysis of the agent’s reasoning.Source: §5 · p. 18

System-level observability and behavior comparison

• AgentSpy deterministically compares system activities across runs and treats reads as behavior, unlike approaches that may ignore them because they do not change system state [7].It can also compare an execution with its assigned skill to expose runs that succeed without using the developers’ guidance.Source: §5 · p. 18

Security analysis and static analyzers of agent skills

• Unlike skill-focused analyzers [27] [10] [29] [30], AgentSpy takes a task, runs the agent in a microVM, and applies system-call rules to any execution.The rules do not refer to a particular skill.Source: §5 · p. 18

6 Conclusion

• 92.2% of comparisons found repeated runs of the same task more similar than sets that included another task’s runs.Among test-passing executions, the analysis found unrelated activities in 18% of cases, grading-file reads in 7%, and results without skill guidance in 17%.Source: §6 · p. 19
• AgentSpy records system calls and network traffic from agents and spawned processes, supporting conformance analyses of obligations and safety analyses of prohibitions.The reliability analysis summarizes each execution as a star graph of commands, files, and hosts.Source: §6 · p. 19
• The security analysis flags four of five attack categories without false alerts.The paper also reports no significant overhead.Source: §6 · p. 19