Skip to main content
Version: 6.1

AI Security

Purpose​

The AI Security module detects security threats affecting AI environments, LLM services, and AI agents in Smart Monitor according to the OWASP Top 10 for LLM Applications. It analyzes LLM requests, AI agent permission configurations, and computing resource utilization to identify anomalies associated with attacks on large language models and agentic systems.

The module covers the following threat detection areas:

  • Prompt injection: attempts to inject instructions into incoming LLM requests
  • Denial of service (DoS): token limit, context length, generation time, and request rate violations, as well as abnormal GPU utilization
  • AI agent permissions: excessive permissions, deviations from the baseline permission profile, and privilege escalation attempts
  • Data leakage: disclosure of sensitive information and system prompts in model responses
  • Model theft: unusual access to model repositories, bulk downloads of model weights, and artifact exfiltration
  • Dangerous actions: dangerous commands in model responses and actions initiated by agents

AI Security architecture

Module Components​

  1. Dashboards: 2 dashboards for LLM threats, agent security, and model theft
  2. Jobs: 27 threat detection jobs grouped by OWASP Top 10 for LLM Applications categories, with automatic incident creation
  3. Lookups: 11 lookups containing attack signatures and baseline values
  4. Data sources: events from local Claude Code, Claude Desktop, and Codex AI agents; snapshots of their permission configurations; and DCGM Exporter GPU metrics

Documentation Sections​