As reported by Elastic Security Labs, a six-month experiment embedding 7,454 turns of AI agent sessions as vector data revealed that one in seven sessions warranted security review — and that the agent's reasoning traces carried significantly more detection signal than the human prompts that triggered them.
This finding lands at a critical moment. Organizations are deploying AI coding agents, autonomous SOC assistants, and agentic workflows at accelerating pace, yet detection infrastructure remains anchored to a model that assumes humans choose the actions. When a human types a request and an agent decides the execution path, traditional rule-based detection breaks down — not because individual actions are disallowed, but because the aggregate session constitutes a risk that no single log entry captures.
The Detection Gap Nobody Wants to Acknowledge
The core problem Elastic identifies is architectural, not tactical. Consider a coding agent that reads a CSV containing customer data, initializes a git repository, adds a remote, and pushes the data externally. Every individual action — reading a file, running git, adding a remote — is typically permitted. No SIEM rule fires. Yet the session as a whole constitutes a data exfiltration event. This is the class of risk that query-based detection was never designed to catch.
Uber's Agentic AI Detection and Response approach, which uses an LLM to review each session in production, represents the current state of the art. But as Elastic correctly notes, it's economically unscalable for threat hunting: each new investigative question requires reprocessing all historical sessions, and LLM-based review introduces non-determinism that complicates alerting and audit trails.
Why Embedding-Based Detection Changes the Equation
The approach Elastic tested — embedding each turn at ingest and storing vectors for subsequent semantic search — addresses both problems. Storage and embedding happen once. Search is iterative and cheap. A defender can describe a suspicious behavior pattern or supply a known-malicious session as a query vector and rank all historical sessions by similarity. Only sessions exceeding a threshold require human or LLM review.
This matters because threat hunting is fundamentally about asking questions nobody thought to ask at collection time. Traditional logging optimizes for queries you anticipated. Semantic vector search optimizes for the questions you discover you need to ask later.
The agent's reasoning carried more signal than the prompt. Detection strategies that focus solely on what users ask agents to do will systematically miss the behaviors that matter.
Broader Implications
This research extends beyond coding agents. As agentic workflows proliferate across customer support, finance operations, and internal automation, the same detection gap applies. An agent authorized to process a refund might take a sequence of individually permissible steps that collectively enable fraud. An agent tasked with cleaning up the database might drop tables that should have been preserved. The industry needs a detection layer operating at the semantic level of agent reasoning, not just the syntactic level of tool calls and permissions.
Shield53 Recommendations
- Log agent reasoning traces, not just tool calls. The Elastic findings confirm that reasoning carries the detection signal. If your agent platform doesn't expose intermediate reasoning, prioritize platforms that do or instrument it yourself.
- Pilot embedding-based session search. Store agent session embeddings in a vector database. Establish a known-good baseline and use similarity search to surface anomalous sessions for human review.
- Define agent session baselines per workflow. Document what normal agent behavior looks like for each use case. This baseline becomes your similarity search anchor for detecting deviations.
- Segment agent permissions aggressively. Until detection matures, constrain what agents can do. The fewer actions available, the smaller the gap between permitted action and harmful session.
- Treat agentic AI detection as strategic risk, not tooling selection. The gap between AI agent adoption and AI agent security monitoring is widening. Organizations that wait for mature off-the-shelf solutions will accumulate months of unaudited agent sessions — roughly 14% of which, per Elastic's data, will contain behaviors worth reviewing.
