AgentSight reads LLM traffic from the Linux kernel, no agent changes required

An Alibaba open-source project called AgentSight attaches a small eBPF tracing program to a Linux host and reads the prompts, token use, and process activity of any LLM-driven agent running there, all without inserting a single line of code into the agent itself. The project re-posted to Show HN this week is a sharper version of a category that has, until now, lived almost entirely in the application layer.

Most agent observability today means logging the prompt, logging the response, counting tokens, and shipping the JSON to a dashboard. AgentSight bets the kernel already sees everything, and that you can lift semantic meaning out of TLS-encrypted traffic by hooking the right syscall. The technique, called "boundary tracing," is described in the August 2025 arXiv paper that introduced the project (PACMI'2025) and walked through in the eunomia.dev writeup the same week.

eBPF — small, sandboxed programs that run safely inside the Linux kernel, the same machinery that powers Cilium and most modern service meshes — intercepts TLS-encrypted traffic at the OpenSSL or BoringSSL boundary so the tracer can read LLM call contents without terminating the connection. A semantic extraction layer turns each captured request into an "intent" record plus token accounting. A real-time engine correlates those semantic events with kernel-level signals: file opens, child processes, network sockets, syscalls. A second, lighter LLM pass analyzes the joined stream and raises the framework's three flagship alarms: prompt-injection patterns, reasoning loops that burn tokens without progress, and coordination bottlenecks in multi-agent setups where one agent is silently waiting on another.

The project claims less than 3% performance overhead, a self-reported figure from the paper abstract, not an independent benchmark. eBPF itself is designed to be cheap, but any kernel-wide program pays in fixed bookkeeping, and the secondary LLM analysis pass is a recurring inference cost the 3% figure does not appear to isolate. The detection claims — prompt injection, reasoning loops, multi-agent bottlenecks — are also author-evaluated: the paper walks through them as worked examples, and no third-party benchmark has been published yet.

The anolisa documentation lists the prerequisites: Linux kernel 5.8 or newer (BTF — the type-info format that lets eBPF programs read kernel structures portably — requires it), root or CAP_BPF privileges, x86_64, and the ANOLISA raw package. macOS gets a degraded mode: a JSONL trajectory scanner and the dashboard viewer, but no eBPF-dependent commands. The bundled systemd service runs as root, the dashboard binds to 0.0.0.0:7396, and the data lands under /var/log/sysak/.agentsight. "Zero instrumentation" here means zero changes inside the agent, not zero changes to the host.

The reference implementation is also split across two repositories. The arXiv paper and the eunomia.dev post both point to github.com/agent-sight/agentsight as the canonical source. The Show HN submission, by contrast, points at the docs page hosted inside alibaba/anolisa. The two repos share the same product name and a heavily overlapping feature surface — Linux eBPF tracing, dashboard, token accounting, behavior audit, auto-discovery, interruption detection — but the code has not been cross-checked in this turn. Treat them as sibling surfaces of the same project until that parity is verified, not as one repo with two URLs.

Most agent failures are not model failures; they are orchestration failures: a tool call that hangs, a loop that burns ten thousand tokens before the model notices, a prompt-injected instruction that quietly steers the agent off-task. Application-layer logging sees the prompt. It does not always see the file the agent just wrote, the subprocess it spawned, or the socket it opened to an external API. A kernel-side tracer does, and it sees them with the agent's cooperation being optional rather than required.

The first team to run AgentSight in anger and publish an independent number on overhead, detection accuracy, and host impact will set the baseline for everyone else who follows.