Infrastructure

AI Workload Security

Is our AI infrastructure secure?

Kernel-level runtime protection for the workloads that run AI — inference servers, RAG platforms, memory stores, agent frameworks, and MCP servers. Catches remote code execution, container escapes, and framework exploits at the system layer.

Fits

Runtime · AI infrastructure

Owned by

Cloud Security · Platform · SecOps

Built on

Agentic Awareness Layer

Why Workload Security

AI infrastructure is a new attack surface.

AI workloads don't behave like the applications your existing runtime tools were built for. A poisoned model file executes on load. An agent framework accepts an unauthenticated HTTP request and hands the attacker RCE. An MCP server binds to 0.0.0.0 by default. Traditional workload protection doesn't understand these primitives — and traditional runtime tools see the traffic but miss the causal chain from prompt to system impact.

50+

CVEs in Frameworks

LangChain, LangFlow, Marimo, Flowise, Dify, PraisonAI, Semantic Kernel, HuggingFace, and growing.

492

Exposed MCP Servers

Public MCP surveys find hundreds of servers bound to public interfaces with weak or no authentication.

CISA

KEV Listed

Langflow RCE (CVE-2025-3248) is on the CISA Known Exploited Vulnerabilities list — actively exploited in the wild.

Prompt → system impact.

Every AI incident has a chain: a prompt arrives, an LLM decides, a tool call executes, a syscall runs, a file changes. Existing runtime tools see one link. Prompt-layer tools see the prompt. Network tools see the traffic. Endpoint tools see the process. None reconstruct the full chain.

Scan0 stitches the complete causal chain — from the prompt that triggered a decision, through the LLM's tool call, down to the syscall that changed a file or opened a socket. One trace. One verdict. Attributed to the agent, the user, and the request that started it.

Why it matters When a production incident happens, the answer to "why did the agent do this?" is a single trace — not a manual correlation across five tools.

Trace · agent-corp-01 · 09:42:11 UTC

CAUSAL CHAIN

Prompt

"Summarize the file at /tmp/report.md, then clean up old logs"

received · via customer portal · session #4821

LLM

tool_call: shell.execute("rm -rf /var/log/*")

gpt-4o · decision reason: "cleanup task" · confidence 0.87

Syscall

execve("/bin/sh", ["-c", "rm -rf /var/log/*"])

pid 40119 · parent: agent-corp-01 · uid 1000

Impact

unlink() · 47,204 files removed · including audit logs

/var/log/audit/* deleted · SOC2 evidence loss

Blocked

Prompt trace shows goal drift + destructive scope expansion. Action blocked before syscall executed.

The attack classes only AI workloads face.

Prompt-to-RCE. Poisoned model files. Inference server container escape. LLM API as command-and-control. These aren't hypothetical — they're documented CVEs being actively exploited today, with attack surface primitives that traditional workload protection wasn't built to see.

Scan0 catches each class at the kernel — where the exploit actually runs — before the impact reaches your data or your infrastructure.

Real Incidents Langflow RCE (CISA KEV). HuggingFace poisoned pickle. SesameOp OpenAI Assistants C2. Each caught at the syscall layer where the exploit becomes real.

Prompt → RCE in agent framework

CVE-2025-3248

HTTP request → Langflow endpoint → code eval → shell RCE

Unauthenticated Langflow RCE — on CISA KEV. Detected at the eBPF syscall layer the moment the framework forks a shell.

Poisoned model → container escape

Pickle Class

HF model load → pickle.load() → arbitrary exec → namespace escape

1.5M+ HuggingFace files carry unsafe pickle deserialization. Kernel sensor sees the escape attempt at the namespace boundary, not just the network exit.

LLM API as command-and-control

SesameOp

Compromised host → OpenAI API → Assistants conversation → C2 payload

Looks like a normal LLM API call to any network sensor. Scan0 detects the behavioral anomaly in the causal chain — process, prompt structure, response pattern.

One sensor. ~17 MB.

A single lightweight binary. Built on eBPF — Linux's native, kernel-verified observation primitive. Deploys as a DaemonSet on K8s, a sidecar on ECS, a systemd unit on EC2 or bare metal. No SDK integration. No application code change. No runtime overhead.

Once running, it sees every AI workload on the host — every syscall, every network call, every file operation, every fork. And it stitches those into the causal chain that Concept 01 makes possible.

Deployment surface Any Linux host. Any container runtime. Any framework. The sensor doesn't care whether the workload is LangChain, LangGraph, custom Python, or a compiled binary — it observes at the kernel, below the framework.

Sensor Spec · scan0-workload-sensor

single binary

eBPF-based. Kernel-verified. No SDK. No code change. Observable at syscall granularity across every AI workload on the host.

~17 MB Binary

K8s

DaemonSet

ECS

Sidecar

EC2

systemd

Bare Metal

systemd

Endpoint

Linux

Overhead

Minimal

Code Change

None

SDK

Not Required

What it protects.

Every AI workload class your enterprise runs. Inference servers hosting your models. RAG platforms serving retrieval. Memory stores holding agent state. Agent frameworks orchestrating decisions. MCP servers granting tool authority.

Not a firewall on top. Not an SDK woven through the code. A kernel sensor beneath all of it — seeing what each workload actually does at the syscall layer, correlating across the causal chain.

Coverage Inference servers · RAG platforms · Memory stores · Agent frameworks · MCP servers · Any Linux workload where AI runs.

Workloads Protected

5 classes · kernel layer

Inference Servers

vLLM · TGI · Ollama · Triton

Model Load Pickle Detection Escape Attempts

RAG Platforms

LangChain · LlamaIndex · Haystack

Serialization Path Traversal Eval Chain

Memory Stores

Vector DBs · Redis · custom stores

Cross-Principal Injection

Agent Frameworks

Langflow · Flowise · Dify · n8n

Unauth RCE Config Drift Template Injection

MCP Servers

Any MCP stdio or SSE server

Command Injection Auth Bypass Sandbox Escape

Where It Fits

Kernel-layer protection — where the exploit becomes real.

AI Workload Security runs during runtime, at the system layer. Complements Risk Posture (pre-runtime) and Agentic Runtime Protection (behavioral evaluation).

Pre-Runtime

Risk Posture

Discovery. Supply chain. Behavioral drift. Configuration.

→

Runtime · System

Workload Security

Prompt → syscall causal chain. RCE, container escape, C2, framework CVEs — caught at the kernel.

→

Runtime · Behavior

Runtime Protection

Six-dimension evaluation. Block, coach, alert on agent decisions.