As cited
Copy frozen at (site build).
regulatory
Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows
A security researcher describes using embedding models stored in Elasticsearch to search and hunt across artificial intelligence (AI) agent sessions for anomalous behavior, comparing this deterministic approach to the probabilistic costs of running large language models (LLMs) for the same task. The method embeds each turn of an agent conversation into vectors across four channels (user input, agent reasoning, agent response, and tool calls), then performs semantic similarity searches to identify sessions needing triage. The approach surfaces one in seven sessions as review-worthy while scaling to organizations with thousands of engineers and millions of annual agent turns.
Why it matters: Security teams adopting AI agents need a scalable way to audit what agents actually do beyond keyword matching; this embedding-based method provides deterministic, reusable threat hunting that costs less than LLM-per-session evaluation and lets defenders ask new questions of historical data without expensive re-analysis.
- Source published
- First seen by Cybersecurity Tracker