Speakers
Description
In times of Fable/Mythos or equivalent LLMs, security fixes and attack-surface hardening increasingly needs to land on production systems now, but data-center fleets, Kubernetes nodes, or embedded/air-gapped devices all typically share long patch-and-reboot cycles.
BPF is the natural vehicle for on-the-fly live mitigations and runtime visibility - to the kernel itself as well as to userspace apps - and in the age of AI-assisted engineering the natural author of those patches is an agent working in a close loop with the operator. We'll present shirudo, which is an agentless BPF-based security platform tailored for exactly this: There is deliberately no config DSL, because agents work far better with code directly. shirudo also fully embraces xattrs, signed BPF and seals all its assets via BPF LSM in order to defend against untrusted root tampering with bpf. In this talk we walk through the operator/target node workflow, architecture internals, demo its capabilities, and discuss gaps and next steps on shirudo, BPF kernel and libbpf loader side.