Thoughts from the Alpha Level team on AI, anomaly detection, security, and more.
Your organization is almost certainly running AI agents today, and probably more than your security team knows about. Those agents already carry real credentials and real access, but static guardrails can't cover every action they might take — agents take too many possible paths to a goal to write a rule for each one. This paper makes the case that monitoring AI agents for unexpected behavior, the same behavioral approach long used against insider threats, is a vital complement to guardrails for catching rogue agents before they become breaches, as well as detecting external agent-driven attacks.
“Generative AI” has become synonymous with large language models — and in cybersecurity, that conflation is costly. Security teams are being sold language-processing tools for a fundamentally non-linguistic problem: detecting anomalous behavior across numerical, temporal, and stateful data. This paper makes the case for purpose-built generative models — HMMs, GMMs, VAEs, and Naive Bayes — as a more rigorous, interpretable foundation for detection than LLMs alone.