Agent-Warden: eBPF-Based Kernel-Native Process-File Provenance Tracking for LLM Agents
Agent-Warden is a kernel-native eBPF framework that tracks how LLM agents interact with processes and files, which is often hidden from standard tracing tools. It manages state using two backends—one based on PID hashes and one using task local storage—to follow complex process derivations and file interactions across different hardware.