Skip to main content
Version: 6.2

AI Security

Purpose​

The AI Security module detects security threats affecting AI environments, LLM services, and AI agents in Smart Monitor according to the OWASP Top 10 for LLM Applications. It analyzes LLM requests, AI agent permission configurations, and computing resource utilization to identify anomalies associated with attacks on large language models and agentic systems.

The module covers the following threat detection areas:

  • prompt injection: detects attempts to inject instructions using static and semantic checks, with additional analysis when an external AI model is connected
  • Denial of service (DoS): token limit, context length, generation time, and request rate violations, as well as abnormal GPU utilization
  • AI agent permissions: excessive permissions, deviations from the baseline permission profile, and privilege escalation attempts
  • Data leakage: disclosure of sensitive information and system prompts in model responses
  • Model theft: unusual access to model repositories, bulk downloads of model weights, and artifact exfiltration
  • Dangerous actions: dangerous commands in model responses and actions initiated by agents

AI Security architecture

Module Components​

  1. Dashboards: 2 dashboards for LLM threats, agent security, and model theft
  2. Jobs: 32 jobs for event processing and threat detection across OWASP Top 10 for LLM Applications categories, including jobs that create incidents
  3. Lookups: 11 lookups containing attack signatures and baseline values
  4. Data sources: events from local Claude Code and Codex AI agents, Claude Desktop logs, agent permission configuration snapshots, and DCGM Exporter GPU metrics
  5. Semantic search model: a model supplied with the module for comparing requests with reference examples of threats

Documentation Sections​