I thought capturing Linux kernel events would help agent monitoring a lot, but so far it doesn't seem to
- Published on
- Reading time
- 18 min read
I replayed 800 AI agent runs inside a sandbox that records what the Linux kernel sees, and asked a small model to watch them with and without that evidence. A pre-registered test couldn't show it helped – here's what I learnt along the way.






