Weixiao Ji

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.

AI agents increasingly run in production through harnesses that hold live credentials and execute shell, file, and network actions. When an agent is prompt-injected or misled, it willingly exfiltrates secrets. Today's defenses split into two camps: tool-call guardrails that miss system actions bypassing the tool layer, and OS-level enforcers that control resource access but cannot see inside encrypted traffic. Both leave two gaps: the real credential remains exposed, and operators cannot prove the agent acted autonomously rather than the human user.
AgentShield is an open-source defense that extends kernel-native enforcement (fanotify permission checks and an eBPF LSM hook) with a TLS interception layer, all driven by a single YAML policy engine and deployed transparently via cgroup discovery with no agent code changes. Two capabilities address the gaps. First, Phantom Credentials: when an agent attempts to use a secret, AgentShield transparently substitutes a decoy at the TLS layer, so a hijacked agent proceeds and exfiltrates useless data while the real key never leaves the host. Second, Causal Attribution: kernel events are stitched into a behavioral chain that attributes actions to the agent's autonomous decision, producing a forensic timeline.
Unlike single-layer kernel enforcers that explicitly scope encryption out, AgentShield's TLS-MITM layer brings payload-level policy and credential substitution within reach. This 50-minute Arsenal session demonstrates both live, plus YAML policy authoring.