Problem-driven and interest-led. We start from questions that matter in networked-systems observability and AI-agent security, then build the measurements, systems, and evidence to answer them.
We choose research problems the way practitioners feel them (a system that cannot be observed, an agent that cannot be trusted) and let genuine interest carry the work across layer boundaries.
Every project starts from a concrete, well-posed question about real systems, never from a technique looking for an application.
We keep room for interest-led exploration. Unexpected behaviors observed in systems often become our next research question.
We work from kernel to network to agent reasoning, because security and observability problems rarely respect layer boundaries.
Two questions currently drive most of our effort. Each is stated the way we ask it in the lab.
LLM agents browse and act on the open web autonomously. Indirect prompt injection lets an ordinary-looking page plant instructions that hijack an agent's control flow, for example by trapping it in execution loops that burn its step, time, and token budgets. This is denial of service at the agent layer, with real cost in tokens and compute, tasks that silently fail, and so far no systematic measurement of how bad it can get.
Today's agent guardrails live in the same layer the attacker manipulates, such as prompts, framework hooks, and application logic. But an agent that reasons its way past application-level checks still cannot hide its syscalls, file accesses, and network egress. Kernel-level visibility through eBPF is tamper-resistant, low-overhead, and agent-agnostic, a fundamentally different place to observe and to enforce.
Our open questions grow out of three long-term themes. Q1 lives in agent security; Q2 is where system observability meets agent security.
Intrusion detection, traffic forensics, and automated vulnerability discovery, including fuzzing and zero-day hunting across networks and agents.
eBPF-based full-stack instrumentation to continuously monitor networked systems with minimal overhead, enabling kernel-to-application tracing in production.
Runtime security, resource-abuse detection, and dependability analysis for LLM-based autonomous agents, bridging OS-level enforcement and agent reasoning.
We are recruiting motivated students who enjoy problem-driven systems and security research.
Join NSOS Lab →