Skip to content

53,600 AI-swarm attacks. Every one stopped in the kernel. 0 bytes leaked.See the evidence

Solomon eBPF Client · EDR and CDR

The kernel acts first.

A Linux EDR and cloud workload protection agent built on eBPF. It denies credential theft, kills attacker process trees and stops container escapes inside the kernel, in microseconds, before an AI swarm can move laterally.

Request a pilot See the evidence
solomon-client · dgx · enforcereplay
  1. swarm100 AI agents · 20 rounds · 3 attack vectorst+0
  2. denyIMDS 169.254.169.254 · connect4 -EPERM211 µs p50
  3. killread ~/.aws/credentials · SIGKILLrc=-9
  4. killscrape /proc/self/environ · SIGKILLrc=-9
  5. wave 110 agents · 600 / 600 blocked0 B
  6. wave 250 agents · 3,000 / 3,000 blocked0 B
  7. wave 3100 agents · 6,000 / 6,000 blocked0 B
  8. clientRSS 181.3 MB (+2.0 MB) · 48 containers upok
9,600 / 9,600 blocked0 bytes leakedzero survivors

Replay of a recorded run, Oct 2026: 10 → 100 concurrent AI agents on an NVIDIA DGX workstation.

Emulated AI-agent swarm evidence run, 1 Oct 2026

Containment1
< 300 µs
bytes leaked across 53,600 swarm attempts2
0
memory, at runtime and at peak under attack3
< 150 MB
CPU on our production server; 0 dropped events in 19 hours4
1.7%
  1. 1Emulated AI-agent swarm evidence run, 1 Oct 2026: credential-file theft denied in 6–34 µs, process-secret dumps in 15–31 µs, attacker process tree killed in 31–130 µs, IMDS theft in 55–200 µs (medians).
  2. 2Emulated AI-agent swarm evidence run, 1 Oct 2026: four environments, every attempt denied or killed inside the kernel.
  3. 3Emulated AI-agent swarm evidence run, 1 Oct 2026: agent memory at runtime and at peak while under attack.
  4. 4Emulated AI-agent swarm evidence run, 1 Oct 2026: in-house production server, 19 hours.

Capabilities

Prevention, not just detection.

Most agents watch and report. The Solomon eBPF Client blocks in the kernel, then tells the Platform what it did.

  • In-kernel enforcement

    • Policy rules run as eBPF programs on BPF LSM hooks, so a denied call never completes
    • Covers credential access, cloud metadata (IMDS), container escape, egress and persistence
    • Signal-based fallback where BPF LSM is not enabled in the kernel

  • Kernel telemetry

    • Process, file and network events straight from the kernel
    • Normalised to OCSF and streamed to the Solomon Platform over mTLS
    • Spooled locally and replayed when the link to the Platform drops

  • AI-asset and secret protection

    • Cloud keys, SSH keys, kubeconfigs and LLM API keys guarded at the file and process level
    • Process-environment secret scraping denied
    • Model and agent assets covered by dedicated rules

  • Containment on command

    • Kill an attacker's whole process tree inside the kernel
    • Isolate a host from the network with in-kernel cgroup filters
    • AI- or analyst-ordered kills reach the host in 4–18 ms end to end

  • Signed policy, fleet control

    • Every policy and command is signed by the Platform and verified on the host
    • Enforce, monitor or kill-switch the whole fleet in 0.5 s, without a restart
    • An exceptions list for the tools and paths you approve

  • Self-protection and YARA

    • The agent defends its own process and files against tampering
    • Deny storms are contained instead of flooding the host
    • Bundled YARA rules scan files on the host

Why microseconds

A swarm finishes in milliseconds. So must the defense.

Without Solomon, a 50-agent swarm took 3.7 MB of AWS, SSH, Kubernetes and LLM API secrets in 17 ms. Cloud SIEMs and polling EDRs see that after it is over.

The eBPF Client decides on the system call itself. Theft of a credentials file is denied in 6–34 µs, and the attacker’s process tree is gone in 31–130 µs, before the agents can spawn helpers or retry.

Emulated AI-agent swarm: 50–100 concurrent workers issuing real attacker system calls against canary data (no exploits, no real credentials) on Amazon Linux 2023, RHEL 9 and Ubuntu 20.04/22.04. Lab results from disposable AWS test hosts, a 2-node EKS cluster and an in-house production server. 6 of 8 kill-chain steps are blocked; shell spawn and covert tunnels are monitored.

Time to stop each swarm technique

Median, log scale

  • Steal cloud credentials fileT1552.0016–34 µs
  • Dump process secretsT155215–31 µs
  • Kill the attacker's process treecontainment31–130 µs
  • Steal cloud role credentials (IMDS)T1552.00555–200 µs
  • AI- or analyst-ordered kill, platform → hostend to end4–18 ms
  • Container escape killedT1611 · incl. process start13–56 ms

Built for production

Light enough to leave on everywhere.

Under attack the agent stayed under 150 MB of memory. On our own production server it used 1.7% CPU, with 0 dropped events in 19 hours. All 48 live containers on the test host kept running, and approved pods on the EKS cluster were not touched. The agent is tested on a 14-target kernel matrix of x86_64 and arm64 hosts.

Policies switch between enforce and monitor fleet-wide in half a second, without restarting anything.

Supported todayLinux
Tested on
Amazon Linux 2023 and 2 · RHEL 9 · Ubuntu 20.04, 22.04 and 24.04
CPU architectures
x86_64 (Intel) · arm64 (AWS Graviton)
Kubernetes
Amazon EKS nodes and pods
Packaging
Signed .deb / .rpm packages · Helm chart
Transport
OCSF over mTLS through the Solomon gateway

Solomon platform

The rest of the loop

Let’s stop the swarm, together.

Run Solomon against your own workloads in a guided pilot. We’ll show you the kernel log, the investigation and the approval, on your infrastructure.

Request a pilot Talk to us