ExecWeave measured the limits of linking agent traces to actual OS effects

An AI agent may claim it executed a tool while the actual system process tree, file changes or network writes differ. ExecWeave records high-level agent actions separately from operating-system events and tries to connect the two only when a process match is uniquely compatible with observed evidence.

The authors explicitly distinguish direct observations, proposed inferences and links for which causality is not established. Their portable-process polling demonstration observed 18 of 30 short-lived child processes at a 20 ms interval but none at a 500 ms interval. The reported Linux workload median wall-time overheads were 408.8%, 85.2% and 62.3% for selected tests.

Abstaining from unjustified attribution is better than turning timing proximity into a false incident story. Yet a missing process can also make a coincidental surviving event appear unique, so audit trails need a completeness model, not just confidence in the graph edge selection.

The observed-identity negative control distinguishes two failure modes. When two compatible processes appear in telemetry, ExecWeave can abstain rather than invent a causal edge. When the true process is omitted and only a compatible impostor remains, that same uniqueness rule may produce an incorrect match. The paper also reports fixed-work median overhead of 408.8%, 85.2% and 62.3% on three Linux workloads. Those are not acceptable universal tracing costs. Any deployment using such a graph for incident attribution must retain unknown observations and support for inferred edges, rather than promoting matched proximity to verified tool effects.

ExecWeave addresses the part that a transcript-only monitor cannot check: whether an action left process, file or network evidence. Its own experiments show why missing telemetry cannot be converted into evidence of no effect; at slower sampling, short-lived children went unobserved. The execution-evidence pattern consequently requires abstention when event collection or attribution is incomplete rather than assigning apparent certainty to a unique remaining match.