Evidence · DiggingBeagle record
ExecWeave: correlating agent execution and OS telemetry without assuming causality
Original implementation and evaluation of semantic tool traces linked to observed process, file and network events.
- Published
- Oct 15, 2026
- Source role
- primary disclosure
Evidence record
Original implementation and evaluation of semantic tool traces linked to observed process, file and network events.
Claim-level citations (3)
- supportsExecWeave measured the limits of linking agent traces to actual OS effects: In a 30-child test, polling at 20 ms observed 18 children, while polling at 500 ms observed none.
Evaluation, process-polling visibility and short-lived child-process counts
- supportsExecWeave measured the limits of linking agent traces to actual OS effects: ExecWeave separates observed events from inferred semantic-to-OS correlations and may abstain when the causal attribution is ambiguous.
System design, correlation logic and evidence-labeling categories
- supportsExecWeave measured the limits of linking agent traces to actual OS effects: ExecWeave negative controls showed that the uniquely compatible observed process can be the wrong one when the true process is not collected; abstaining on visible ambiguity alone does not guarantee sound attribution.
Paper Sections VIII and XI, false-uniqueness negative control and discussion