Promptware EOD: Detonating Agent Skills and Reading the Kernel Instead of the Report ([un]prompted II)

A skill that says what it does is a document. A skill observed doing it is a measurement. Tamir Ishay Sharbat (Zenity) and Joao Donato bring the difference to [un]prompted II — people type it unprompted — and theirs is one of the few sessions in our guide to the conference with output you can run yourself. The disputable claim: an agent's account of its own behaviour is not evidence, and almost every production control reads the account.

They speak on Day 1, Stage 2, at 12:00, per the official agenda as published on 2026-10-12. Donato is listed with no company. This brief is written from the published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following remotely. Nothing here is a quote, and the agenda can change.

What the talk says it will show

A detonation chamber that runs agent skills and compares what the agent reports against kernel-level activity. Tens of thousands of skills tested, hundreds malicious. The chamber is being released publicly.

Our arithmetic, not theirs: hundreds out of tens of thousands lands near a percent, and the figures are too round for more precision. Set that against the other prevalence result on the same stage — Gabi Nakibly and Zvika Babo (Radware) report about 2.5 hidden-text prompt injections per 100,000 GitHub items, 25 minutes earlier — and the denominators are doing the work. A skill is something a person published for an agent to execute; a GitHub item is anything at all.

The gap between the report and the syscall

Detonation is old; malware sandboxes have compared claimed with observed behaviour for twenty years. The self-report is new. The artifact is partly natural language, it describes its own purpose, and the runtime asks a model to summarise what it did. So one execution now produces three stories: what the skill said it would do, what the agent said it did, and what the kernel saw. The finding is the distance between the second and the third.

That matters because the second story is what production controls consume. Approval prompts show a human a summary written by the agent — the point Felipe Zimmerle (CTO, KonaSense) and Rodrigo Branco (Vulnerability Researcher, Anthropic) make on Day 3, arguing agent authorization is not a vault problem. If the summary and the syscalls disagree, the approval layer is reading fiction. That is the sixth of our six arguments: approval is theatre unless the human sees the bytes.

We set out what evidence a tool call must leave in detecting malicious tool calls, and the isolation it needs in sandboxing agent tool calls. A chamber instrumented below the agent supplies the missing half: ground truth for the agent's story.

Two unprompted talks scanning the same artifact class

Session	Method, and what it cannot see
Promptware EOD — Tamir Ishay Sharbat (Zenity), Joao Donato. Day 1, Stage 2, 12:00	Dynamic: run the skill, watch the kernel, compare with the agent's report. Catches behaviour nobody declared. Cannot catch what the skill declines to do inside a chamber.
BITE — Daniel Geyshis (Head of AI, Knostic), Tamir Isaschar (Senior Security Researcher, Knostic). Day 3, Stage 1, 16:20	Maps individual behavioural signals, links them into chains, and compares each chain against the artifact's stated purpose, to cut false positives while keeping verdicts traceable to evidence. Covers extensions and MCP servers too.

What we will be watching for

• What the report-versus-kernel gap looks like in practice: omission, mislabelling, or a confident description of an action that never happened.
• What a malicious skill does first. Credential or token read, outbound connection, or writing to another skill's configuration — the order is the detection opportunity.
• What the chamber needs to run, whether a team can point it at its own library, and what it does when a skill behaves differently because it is watched.

If this holds, what changes on Monday

Inventory your skills. Most teams can name their MCP servers but not the skills installed next to them, so the artifact class with the higher malicious rate is the one nobody owns. Build the list; the chamber is useless without it.

Then stop accepting agent self-report as a log. Whatever the agent says it did belongs in the record as a claim, next to an independently captured line of what the process touched. Where you cannot capture the second line, say so rather than pretending the first is evidence.

Three questions we would ask Tamir Ishay Sharbat and Joao Donato

1. What does the gap between report and kernel activity usually look like — is the agent omitting, misdescribing, or inventing?
2. What does a malicious skill typically do first, and does that first action give defenders a usable signal?
3. What does a team need in place to run the chamber against its own skill library, and what will it fail to tell them?